Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support Defender Plan for Cosmos DB #200

Merged
merged 8 commits into from
Mar 5, 2022
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions azresources/security-center/asc.bicep
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ var azureDefenderServices = [
'Arm'
'AppServices'
'Containers'
'CosmosDbs'
'Dns'
'KeyVaults'
'OpenSourceRelationalDatabases'
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
{
"name": "Configure Microsoft Defender for Cosmos DB to be enabled",
"mode": "all"
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
{
"pricingTier": {
"type": "string",
"metadata": {
"displayName": "Azure Defender pricing tier",
"description": "Azure Defender pricing tier"
},
"allowedValues": [
"Standard",
"Free"
],
"defaultValue": "Standard"
},
"effect": {
"type": "string",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"DeployIfNotExists",
"Disabled"
],
"defaultValue": "DeployIfNotExists"
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,69 @@
{
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Resources/subscriptions"
}
]
},
"then": {
"effect": "[parameters('effect')]",
"details": {
"type": "Microsoft.Security/pricings",
"name": "CosmosDbs",
"deploymentScope": "Subscription",
"existenceScope": "Subscription",
"roleDefinitionIds": [
"/providers/Microsoft.Authorization/roleDefinitions/fb1c8493-542b-48eb-b624-b4c8fea62acd"
],
"existenceCondition": {
"allOf": [
{
"field": "Microsoft.Security/pricings/pricingTier",
"equals": "[parameters('pricingTier')]"
},
{
"field": "type",
"equals": "Microsoft.Security/pricings"
}
]
},
"deployment": {
"location": "canadacentral",
"properties": {
"mode": "incremental",
"parameters": {
"pricingTier": {
"value": "[parameters('pricingTier')]"
}
},
"template": {
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"pricingTier": {
"type": "string",
"metadata": {
"description": "Azure Defender pricing tier"
}
}
},
"variables": {},
"resources": [
{
"type": "Microsoft.Security/pricings",
"apiVersion": "2018-06-01",
"name": "CosmosDbs",
"properties": {
"pricingTier": "[parameters('pricingTier')]"
}
}
],
"outputs": {}
}
}
}
}
}
}
13 changes: 13 additions & 0 deletions policy/custom/definitions/policyset/DefenderForCloud.bicep
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,11 @@

targetScope = 'managementGroup'

@description('Management Group scope for the policy definition.')
param policyDefinitionManagementGroupId string

var customPolicyDefinitionMgScope = tenantResourceId('Microsoft.Management/managementGroups', policyDefinitionManagementGroupId)

resource ascAzureDefender 'Microsoft.Authorization/policySetDefinitions@2020-03-01' = {
name: 'custom-enable-azure-defender'
properties: {
Expand Down Expand Up @@ -164,6 +169,14 @@ resource ascAzureDefender 'Microsoft.Authorization/policySetDefinitions@2020-03-
policyDefinitionReferenceId: toLower(replace('Configure Microsoft Defender for Containers to be enabled', ' ', '-'))
parameters: {}
}
{
groupNames: [
'EXTRA'
]
policyDefinitionId: extensionResourceId(customPolicyDefinitionMgScope, 'Microsoft.Authorization/policyDefinitions', 'DefenderForCloud-Deploy-DefenderPlan-CosmosDB')
policyDefinitionReferenceId: toLower(replace('Configure Microsoft Defender for Cosmos DB to be enabled', ' ', '-'))
parameters: {}
}
]
}
}
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {}
"parameters": {
"policyDefinitionManagementGroupId": {
"value": "{{var-topLevelManagementGroupName}}"
}
}
}