forked from Azure/PSRule.Rules.Azure
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
WAF rule updates Azure#3102 (Azure#3225)
- Loading branch information
1 parent
da656a8
commit 463bc40
Showing
13 changed files
with
368 additions
and
44 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,26 +1,37 @@ | ||
| --- | ||
| severity: Awareness | ||
| pillar: Operational Excellence | ||
| category: Configuration | ||
| pillar: Security | ||
| category: SE:08 Hardening resources | ||
| resource: API Management | ||
| online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.APIM.SampleProducts/ | ||
| --- | ||
|
|
||
| # Remove default products | ||
| # API Management Service has default products present | ||
|
|
||
| ## SYNOPSIS | ||
|
|
||
| Remove starter and unlimited sample products. | ||
| API Management Services with default products configured may expose more APIs than intended. | ||
|
|
||
| ## DESCRIPTION | ||
|
|
||
| API Management includes two sample products _Starter_ and _Unlimited_. | ||
| Accidentally adding APIs to these sample products may expose APIs more than intended. | ||
| These products are created by default when an API Management Service using V1 plans is created. | ||
|
|
||
| In both cases, these products are created with a default set of developer permissions that may be too permissive. | ||
| Accidentally adding APIs to these sample products may expose API metadata to unauthorized users. | ||
|
|
||
| Before publishing APIs, plan access control for API development and usage. | ||
| Additional products or workspaces can be created to manage discovery of APIs and enforce usage policies. | ||
|
|
||
| ## RECOMMENDATION | ||
|
|
||
| Consider removing starter and unlimited sample products from API Management. | ||
| Consider removing starter and unlimited products from API Management to reduce the risk of unauthorized API discovery. | ||
|
|
||
| ## NOTES | ||
|
|
||
| This rule applies when analyzing API Management Services (in-flight) and running within Azure. | ||
|
|
||
| ## LINKS | ||
|
|
||
| - [SE:08 Hardening resources](https://learn.microsoft.com/azure/well-architected/security/harden-resources) | ||
| - [Create and publish a product](https://learn.microsoft.com/azure/api-management/api-management-howto-add-products) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,27 +1,105 @@ | ||
| --- | ||
| reviewed: 2025-01-17 | ||
| severity: Critical | ||
| pillar: Security | ||
| category: Network security and containment | ||
| category: SE:06 Network controls | ||
| resource: Logic App | ||
| online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.LogicApp.LimitHTTPTrigger/ | ||
| --- | ||
|
|
||
| # Limit Logic App HTTP request triggers | ||
| # Logic App HTTP request trigger is not restricted | ||
|
|
||
| ## SYNOPSIS | ||
|
|
||
| Limit HTTP request trigger access to trusted IP addresses. | ||
| Logic Apps using HTTP triggers without restrictions can be accessed from any network location including the Internet. | ||
|
|
||
| ## DESCRIPTION | ||
|
|
||
| When a Logic App uses a HTTP request trigger by default any source IP address can trigger the workflow. | ||
| Logic Apps can be configured to limit the IP addresses that are accepted to trigger the workflow. | ||
| Logic Apps are workflows that integrate services and systems across cloud services and on-premises systems. | ||
| Logic Apps can be triggered by a variety of events including HTTP requests. | ||
|
|
||
| When HTTP request trigger is configured, | ||
| by default the Logic App in a consumption plan may receive requests from any source IP address. | ||
| This can expose the Logic App to unauthorized access or exfiltration attempts. | ||
|
|
||
| Logic Apps can be secured by restricting access to trusted IP addresses. | ||
|
|
||
| ## RECOMMENDATION | ||
|
|
||
| Consider limiting Logic Apps with HTTP request triggers to trusted IP addresses. | ||
| Consider restricting HTTP triggers to trusted IP addresses to harden against unauthorized access or exfiltration attempts. | ||
|
|
||
| ## EXAMPLES | ||
|
|
||
| ### Configure with Azure template | ||
|
|
||
| To deploy Logic Apps that pass this rule: | ||
|
|
||
| - Set the `allowedCallerIpAddresses` property to a list of IP address ranges. | ||
|
|
||
| For example: | ||
|
|
||
| ```json | ||
| { | ||
| "type": "Microsoft.Logic/workflows", | ||
| "apiVersion": "2019-05-01", | ||
| "name": "[parameters('name')]", | ||
| "location": "[parameters('location')]", | ||
| "properties": { | ||
| "definition": "<workflow-definition>", | ||
| "parameters": {}, | ||
| "accessControl": { | ||
| "contents": { | ||
| "allowedCallerIpAddresses": [ | ||
| { | ||
| "addressRange": "192.168.12.0/23" | ||
| }, | ||
| { | ||
| "addressRange": "2001:0db8::/64" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| ### Configure with Bicep | ||
|
|
||
| To deploy Logic Apps that pass this rule: | ||
|
|
||
| - Set the `allowedCallerIpAddresses` property to a list of IP address ranges. | ||
|
|
||
| For example: | ||
|
|
||
| ```bicep | ||
| resource app 'Microsoft.Logic/workflows@2019-05-01' = { | ||
| name: name | ||
| location: location | ||
| properties: { | ||
| definition: '<workflow-definition>' | ||
| parameters: {} | ||
| accessControl: { | ||
| contents: { | ||
| allowedCallerIpAddresses: [ | ||
| { | ||
| addressRange: '192.168.12.0/23' | ||
| } | ||
| { | ||
| addressRange: '2001:0db8::/64' | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| ## NOTES | ||
|
|
||
| This rule currently only applies to Logic Apps using consumption plans. | ||
|
|
||
| ## LINKS | ||
|
|
||
| - [SE:06 Network controls](https://learn.microsoft.com/azure/well-architected/security/networking) | ||
| - [Secure access and data in Azure Logic Apps](https://learn.microsoft.com/azure/logic-apps/logic-apps-securing-a-logic-app) | ||
| - [Azure security baseline for Logic Apps](https://learn.microsoft.com/azure/logic-apps/security-baseline#network-security) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,29 +1,161 @@ | ||
| --- | ||
| severity: Important | ||
| pillar: Operational Excellence | ||
| category: Monitoring | ||
| category: OE:10 Automation design | ||
| resource: Virtual Machine | ||
| online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.VM.Agent/ | ||
| ms-content-id: e4f6f6e7-593c-4507-811d-778ee8ec9ac4 | ||
| --- | ||
|
|
||
| # VM agent is provisioned automatically | ||
| # Virtual Machine agent is not provisioned | ||
|
|
||
| ## SYNOPSIS | ||
|
|
||
| Ensure the VM agent is provisioned automatically. | ||
| Virtual Machines (VMs) without an agent provisioned are unable to use monitoring, management, and security extensions. | ||
|
|
||
| ## DESCRIPTION | ||
|
|
||
| The virtual machine (VM) agent is required for most functionality that interacts with the guest operating system. | ||
| This includes any VMs extensions such as Azure monitoring, management, and security features. | ||
|
|
||
| VM extensions help reduce management overhead by providing an entry point to bootstrap monitoring and configuration of the guest operating system. | ||
| The VM agent is required to use any VM extensions. | ||
| Extensions help reduce management overhead by providing an entry point to bootstrap VM monitoring and configuration. | ||
|
|
||
| By default, the VM agent is provisioned for all supported operating systems. | ||
|
|
||
| ## RECOMMENDATION | ||
|
|
||
| Automatically provision the VM agent for all supported operating systems, this is the default. | ||
| Consider automatically provisioning the VM agent for all supported operating systems to reduce management overhead of VMs. | ||
|
|
||
| ## EXAMPLES | ||
|
|
||
| ### Configure with Azure template | ||
|
|
||
| To deploy VMs that pass this rule: | ||
|
|
||
| - Set the `properties.osProfile.linuxConfiguration.provisionVMAgent` property to `true` for Linux VMs. | ||
| - Set the `properties.osProfile.windowsConfiguration.provisionVMAgent` property to `true` for Windows VMs. | ||
|
|
||
| For example: | ||
|
|
||
| ```json | ||
| { | ||
| "type": "Microsoft.Compute/virtualMachines", | ||
| "apiVersion": "2024-03-01", | ||
| "name": "[parameters('name')]", | ||
| "location": "[parameters('location')]", | ||
| "identity": { | ||
| "type": "SystemAssigned" | ||
| }, | ||
| "properties": { | ||
| "hardwareProfile": { | ||
| "vmSize": "Standard_D8d_v5" | ||
| }, | ||
| "osProfile": { | ||
| "computerName": "[parameters('name')]", | ||
| "adminUsername": "[parameters('adminUsername')]", | ||
| "linuxConfiguration": { | ||
| "provisionVMAgent": true, | ||
| "disablePasswordAuthentication": true | ||
| } | ||
| }, | ||
| "storageProfile": { | ||
| "imageReference": { | ||
| "publisher": "MicrosoftCblMariner", | ||
| "offer": "Cbl-Mariner", | ||
| "sku": "cbl-mariner-2-gen2", | ||
| "version": "latest" | ||
| }, | ||
| "osDisk": { | ||
| "name": "[format('{0}-disk0', parameters('name'))]", | ||
| "caching": "ReadWrite", | ||
| "createOption": "FromImage", | ||
| "managedDisk": { | ||
| "storageAccountType": "Premium_LRS" | ||
| } | ||
| } | ||
| }, | ||
| "networkProfile": { | ||
| "networkInterfaces": [ | ||
| { | ||
| "id": "[resourceId('Microsoft.Network/networkInterfaces', parameters('nicName'))]" | ||
| } | ||
| ] | ||
| } | ||
| }, | ||
| "zones": [ | ||
| "1" | ||
| ], | ||
| "dependsOn": [ | ||
| "[resourceId('Microsoft.Network/networkInterfaces', parameters('nicName'))]" | ||
| ] | ||
| } | ||
| ``` | ||
|
|
||
| ### Configure with Bicep | ||
|
|
||
| To deploy VMs that pass this rule: | ||
|
|
||
| - Set the `properties.osProfile.linuxConfiguration.provisionVMAgent` property to `true` for Linux VMs. | ||
| - Set the `properties.osProfile.windowsConfiguration.provisionVMAgent` property to `true` for Windows VMs. | ||
|
|
||
| For example: | ||
|
|
||
| ```bicep | ||
| resource linux 'Microsoft.Compute/virtualMachines@2024-03-01' = { | ||
| name: name | ||
| location: location | ||
| identity: { | ||
| type: 'SystemAssigned' | ||
| } | ||
| properties: { | ||
| hardwareProfile: { | ||
| vmSize: 'Standard_D8d_v5' | ||
| } | ||
| osProfile: { | ||
| computerName: name | ||
| adminUsername: adminUsername | ||
| linuxConfiguration: { | ||
| provisionVMAgent: true | ||
| disablePasswordAuthentication: true | ||
| } | ||
| } | ||
| storageProfile: { | ||
| imageReference: { | ||
| publisher: 'MicrosoftCblMariner' | ||
| offer: 'Cbl-Mariner' | ||
| sku: 'cbl-mariner-2-gen2' | ||
| version: 'latest' | ||
| } | ||
| osDisk: { | ||
| name: '${name}-disk0' | ||
| caching: 'ReadWrite' | ||
| createOption: 'FromImage' | ||
| managedDisk: { | ||
| storageAccountType: 'Premium_LRS' | ||
| } | ||
| } | ||
| } | ||
| networkProfile: { | ||
| networkInterfaces: [ | ||
| { | ||
| id: nic.id | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| zones: [ | ||
| '1' | ||
| ] | ||
| } | ||
| ``` | ||
|
|
||
| ## NOTES | ||
|
|
||
| In general provisioning the VM agent is recommended for all supported operating systems. | ||
| For network virtual appliances (NVAs) or specialized unsupported OS images installed from the Azure Marketplace, | ||
| the VM agent may be disabled by the publisher. | ||
|
|
||
| ## LINKS | ||
|
|
||
| - [OE:10 Automation design](https://learn.microsoft.com/azure/well-architected/operational-excellence/enable-automation) | ||
| - [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.compute/virtualmachines) |
Oops, something went wrong.