From 96d8e546255431e4c07f9ae573a08c835d552429 Mon Sep 17 00:00:00 2001 From: github-actions Date: Wed, 30 Sep 2026 08:04:04 +0000 Subject: [PATCH 1/2] feat: Update Policy Library (automated) --- .../_policySetDefinitionsBicepInput.txt | 50 +++++++ ...tion_es_Enforce-Guardrails-Automation.json | 10 +- ...orce-Guardrails-Automation.parameters.json | 2 +- ...nforce-Guardrails-Automation_20260910.json | 124 ++++++++++++++++++ ...drails-Automation_20260910.parameters.json | 37 ++++++ ...inition_es_Enforce-Guardrails-Compute.json | 22 +++- ...Enforce-Guardrails-Compute.parameters.json | 7 + 7 files changed, 246 insertions(+), 6 deletions(-) create mode 100644 infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation_20260910.json create mode 100644 infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation_20260910.parameters.json diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/_policySetDefinitionsBicepInput.txt b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/_policySetDefinitionsBicepInput.txt index eafbdd8c1..f9bca33f7 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/_policySetDefinitionsBicepInput.txt +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/_policySetDefinitionsBicepInput.txt @@ -2124,6 +2124,47 @@ var varCustomPolicySetDefinitionsArray = [ } ] } + { + name: 'Enforce-Guardrails-Automation_20260910' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation_20260910.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Aa-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/48c5f1cb-14ad-4797-8e3b-f78ab3f8d700' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomation_20260910Parameters['Deny-Aa-Local-Auth'].parameters + definitionGroups: [] + definitionVersion: '1.*.*' + } + { + definitionReferenceId: 'Deny-Aa-Managed-Identity' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/dea83a72-443c-4292-83d5-54a2f98749c0' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomation_20260910Parameters['Deny-Aa-Managed-Identity'].parameters + definitionGroups: [] + definitionVersion: '1.*.*' + } + { + definitionReferenceId: 'Deny-Aa-Variables-Encrypt' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3657f5a0-770e-44a3-b44e-9431ba1e9735' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomation_20260910Parameters['Deny-Aa-Variables-Encrypt'].parameters + definitionGroups: [] + definitionVersion: '1.*.*' + } + { + definitionReferenceId: 'Modify-Aa-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/30d1d58e-8f96-47a5-8564-499a3f3cca81' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomation_20260910Parameters['Modify-Aa-Local-Auth'].parameters + definitionGroups: [] + definitionVersion: '1.*.*' + } + { + definitionReferenceId: 'Modify-Aa-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/23b36a7c-9d26-4288-a8fd-c1d2fa284d8c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomation_20260910Parameters['Modify-Aa-Public-Network-Access'].parameters + definitionGroups: [] + definitionVersion: '1.*.*' + } + ] + } { name: 'Enforce-Guardrails-Automation' libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.json') @@ -2293,6 +2334,13 @@ var varCustomPolicySetDefinitionsArray = [ definitionGroups: [] definitionVersion: '1.*.*' } + { + definitionReferenceId: 'Deny-Windows-Vm-HotPatch' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6d02d2f7-e38b-4bdc-96f3-adc0a8726abc' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsComputeParameters['Deny-Windows-Vm-HotPatch'].parameters + definitionGroups: [] + definitionVersion: '1.*.*' + } ] } { @@ -3838,6 +3886,8 @@ var varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters = loadJsonContent('l var varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-AppServices.parameters.json') +var varPolicySetDefinitionEsEnforceGuardrailsAutomation_20260910Parameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation_20260910.parameters.json') + var varPolicySetDefinitionEsEnforceGuardrailsAutomationParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.parameters.json') var varPolicySetDefinitionEsEnforceGuardrailsBotServiceParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-BotService.parameters.json') diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.json index 3c73e54e1..9950fc5c2 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.json @@ -5,12 +5,14 @@ "scope": null, "properties": { "policyType": "Custom", - "displayName": "Enforce recommended guardrails for Automation Account", - "description": "This policy initiative is a group of policies that ensures Automation Account is compliant per regulated Landing Zones.", + "displayName": "[Deprecated]: Enforce recommended guardrails for Automation Account", + "description": "This policy initiative is a group of policies that ensures Automation Account is compliant per regulated Landing Zones. Superseded by https://www.azadvertizer.net/azpolicyinitiativesadvertizer/Enforce-Guardrails-Automation_20260910.html", "metadata": { - "version": "1.1.0", + "version": "1.1.0-deprecated", "category": "Automation", "source": "https://github.com/Azure/Enterprise-Scale/", + "deprecated": true, + "supersededBy": "Enforce-Guardrails-Automation_20260910", "alzCloudEnvironments": [ "AzureCloud", "AzureChinaCloud", @@ -120,7 +122,7 @@ "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/30d1d58e-8f96-47a5-8564-499a3f3cca81", "parameters": { "effect": { - "value": "[[parameters('aaModifyLocalAUth')]" + "value": "[[parameters('aaModifyLocalAuth')]" } }, "groupNames": [], diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.parameters.json index 1bc6a2f51..4349a1df5 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.parameters.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.parameters.json @@ -30,7 +30,7 @@ "Modify-Aa-Local-Auth": { "parameters": { "effect": { - "value": "[[parameters('aaModifyLocalAUth')]" + "value": "[[parameters('aaModifyLocalAuth')]" } } }, diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation_20260910.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation_20260910.json new file mode 100644 index 000000000..4f045b05c --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation_20260910.json @@ -0,0 +1,124 @@ +{ + "name": "Enforce-Guardrails-Automation_20260910", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Automation Account", + "description": "This policy initiative is a group of policies that ensures Automation Account is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Automation", + "source": "https://github.com/Azure/Enterprise-Scale/", + "replacesPolicy": "Enforce-Guardrails-Automation", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "aaModifyLocalAuth": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "aaVariablesEncryption": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Disabled", + "Deny" + ] + }, + "aaLocalAuth": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Disabled", + "Deny" + ] + }, + "aaManagedIdentity": { + "type": "string", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Disabled" + ] + }, + "aaModifyPublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-Aa-Managed-Identity", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/dea83a72-443c-4292-83d5-54a2f98749c0", + "parameters": { + "effect": { + "value": "[[parameters('aaManagedIdentity')]" + } + }, + "groupNames": [], + "definitionVersion": "1.*.*" + }, + { + "policyDefinitionReferenceId": "Deny-Aa-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/48c5f1cb-14ad-4797-8e3b-f78ab3f8d700", + "parameters": { + "effect": { + "value": "[[parameters('aaLocalAuth')]" + } + }, + "groupNames": [], + "definitionVersion": "1.*.*" + }, + { + "policyDefinitionReferenceId": "Deny-Aa-Variables-Encrypt", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3657f5a0-770e-44a3-b44e-9431ba1e9735", + "parameters": { + "effect": { + "value": "[[parameters('aaVariablesEncryption')]" + } + }, + "groupNames": [], + "definitionVersion": "1.*.*" + }, + { + "policyDefinitionReferenceId": "Modify-Aa-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/30d1d58e-8f96-47a5-8564-499a3f3cca81", + "parameters": { + "effect": { + "value": "[[parameters('aaModifyLocalAuth')]" + } + }, + "groupNames": [], + "definitionVersion": "1.*.*" + }, + { + "policyDefinitionReferenceId": "Modify-Aa-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/23b36a7c-9d26-4288-a8fd-c1d2fa284d8c", + "parameters": { + "effect": { + "value": "[[parameters('aaModifyPublicNetworkAccess')]" + } + }, + "groupNames": [], + "definitionVersion": "1.*.*" + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation_20260910.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation_20260910.parameters.json new file mode 100644 index 000000000..29cac2428 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation_20260910.parameters.json @@ -0,0 +1,37 @@ +{ + "Deny-Aa-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('aaLocalAuth')]" + } + } + }, + "Deny-Aa-Managed-Identity": { + "parameters": { + "effect": { + "value": "[[parameters('aaManagedIdentity')]" + } + } + }, + "Deny-Aa-Variables-Encrypt": { + "parameters": { + "effect": { + "value": "[[parameters('aaVariablesEncryption')]" + } + } + }, + "Modify-Aa-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('aaModifyLocalAuth')]" + } + } + }, + "Modify-Aa-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('aaModifyPublicNetworkAccess')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.json index 830cc94e9..22ceea4f0 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.json @@ -8,7 +8,7 @@ "displayName": "Enforce recommended guardrails for Compute", "description": "This policy initiative is a group of policies that ensures Compute is compliant per regulated Landing Zones.", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Compute", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ @@ -27,6 +27,15 @@ "Disabled" ] }, + "autoHotPatch": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Disabled", + "Deny" + ] + }, "vmAndVmssEncryptionHost": { "type": "string", "defaultValue": "Deny", @@ -38,6 +47,17 @@ } }, "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-Windows-Vm-HotPatch", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6d02d2f7-e38b-4bdc-96f3-adc0a8726abc", + "parameters": { + "effect": { + "value": "[[parameters('autoHotPatch')]" + } + }, + "groupNames": [], + "definitionVersion": "1.*.*" + }, { "policyDefinitionReferenceId": "Deny-VmAndVmss-Encryption-Host", "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/fc4d8e41-e223-45ea-9bf5-eada37891d87", diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.parameters.json index 88a10b95e..75a71ee64 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.parameters.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.parameters.json @@ -12,5 +12,12 @@ "value": "[[parameters('vmAndVmssEncryptionHost')]" } } + }, + "Deny-Windows-Vm-HotPatch": { + "parameters": { + "effect": { + "value": "[[parameters('autoHotPatch')]" + } + } } } From 8e170974ceef605e8cebfc410671457cc718ec2b Mon Sep 17 00:00:00 2001 From: github-actions Date: Fri, 9 Oct 2026 08:07:08 +0000 Subject: [PATCH 2/2] feat: Update Policy Library (automated) --- .../policy_definition_es_DenyAction-ActivityLogs.json | 4 ++-- .../policy_definition_es_DenyAction-DiagnosticLogs.json | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_DenyAction-ActivityLogs.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_DenyAction-ActivityLogs.json index c097e97de..d84f98314 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_DenyAction-ActivityLogs.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_DenyAction-ActivityLogs.json @@ -5,12 +5,12 @@ "scope": null, "properties": { "policyType": "Custom", - "mode": "Indexed", + "mode": "All", "displayName": "DenyAction implementation on Activity Logs", "description": "This is a DenyAction implementation policy on Activity Logs.", "metadata": { "deprecated": false, - "version": "1.0.0", + "version": "1.0.1", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_DenyAction-DiagnosticLogs.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_DenyAction-DiagnosticLogs.json index a33f10c1f..fd3e243ca 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_DenyAction-DiagnosticLogs.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_DenyAction-DiagnosticLogs.json @@ -5,12 +5,12 @@ "scope": null, "properties": { "policyType": "Custom", - "mode": "Indexed", + "mode": "All", "displayName": "DenyAction implementation on Diagnostic Logs.", "description": "DenyAction implementation on Diagnostic Logs.", "metadata": { "deprecated": false, - "version": "1.0.0", + "version": "1.0.1", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [