optionally deploy built-in Policy Initiatives for NIST 800-53, CMMC Level 3, or DOD IL5

src/bicep/README.md

@@ -64,6 +64,26 @@ az deployment sub create \
     operationsSubscriptionId=$operationsSubscriptionId \
     sharedServicesSubscriptionId=$sharedServicesSubscriptionId
 ```
+### Adding Azure Policy
+To include one of the built in Azure policy initiatives for NIST 800-53, CMMC Level 3 or DoD IL5 compliance add the parameter with one of the following, NIST, IL5 or CMMC. For example deploying with MLZ: 
+```
+az deployment sub create \
+  --location eastus \
+  --template-file mlz.bicep \
+  --parameters policy=<one of 'CMMC', 'IL5', or 'NIST'>
+  ```
+For example deploying after MLZ:
+```
+az deployment group create \
+  --resource-group <Resource Group to assign> \
+  --name <original deployment name + descriptor> \
+  --template-file ./src/bicep/modules/policyAssignment.bicep \
+  --parameters builtInAssignment=<one of 'CMMC', 'IL5', or 'NIST'> logAnalyticsWorkspaceName=<Log analytics workspace name> workspaceResourceGroupName=<LA Workspace resource group name>
+```
+
+Under the modules\policies directory are files named accordingly for the initiatives parameters with defaults  except for where a Log Analytics workspace ID is required we substitute that with the MLZ workspace ID, All others can be changed appropriately.
+
+The result will be a policy assignment created for each resource group deployed by MLZ base fabric which can be viewed in the 'Compliance' view of Azure Policy in the portal.
 
 ### Air-Gapped Clouds
 

src/bicep/mlz.bicep

@@ -252,6 +252,58 @@ module sharedServicesVirtualNetworkPeering './modules/spokeNetworkPeering.bicep'
   }
 }
 
+module hubPolicyAssignment './modules/policyAssignment.bicep' = {
+  name: '${hubResourceGroupName}-policyAssignement'
+  scope: resourceGroup(hubSubscriptionId, hubResourceGroupName)
+  dependsOn: [
+    hubResourceGroup
+    logAnalyticsWorkspace
+  ]
+  params: {
+    builtInAssignment: policy
+    logAnalyticsWorkspaceName: logAnalyticsWorkspace.outputs.name
+    logAnalyticsWorkspaceResourceGroupName: operationsResourceGroup.outputs.name
+  }
+}
+
+module operationsPolicyAssignment './modules/policyAssignment.bicep' = {
+  name: '${operationsResourceGroupName}-policyAssignment'
+  scope: resourceGroup(operationsSubscriptionId, operationsResourceGroupName)
+  params: {
+    builtInAssignment: policy
+    logAnalyticsWorkspaceName: logAnalyticsWorkspace.outputs.name
+    logAnalyticsWorkspaceResourceGroupName: operationsResourceGroup.outputs.name
+  }
+}
+
+module sharedServicesPolicyAssignment './modules/policyAssignment.bicep' = {
+  name: '${sharedServicesResourceGroupName}-policyAssignement'
+  scope: resourceGroup(sharedServicesSubscriptionId, sharedServicesResourceGroupName)
+  dependsOn: [
+    sharedServicesResourceGroup
+    logAnalyticsWorkspace
+  ]
+  params: {
+    builtInAssignment: policy
+    logAnalyticsWorkspaceName: logAnalyticsWorkspace.outputs.name
+    logAnalyticsWorkspaceResourceGroupName: operationsResourceGroup.outputs.name
+  }
+}
+
+module identityPolicyAssignment './modules/policyAssignment.bicep' = {
+  name: '${identityResourceGroupName}-policyAssignement'
+  scope: resourceGroup(identitySubscriptionId, identityResourceGroupName)
+  dependsOn: [
+    identityResourceGroup
+    logAnalyticsWorkspace
+  ]
+  params: {
+    builtInAssignment: policy
+    logAnalyticsWorkspaceName: logAnalyticsWorkspace.outputs.name
+    logAnalyticsWorkspaceResourceGroupName: operationsResourceGroup.outputs.name
+  }
+}
+
 // parameters
 @minLength(3)
 @maxLength(24)
@@ -351,6 +403,15 @@ param logAnalyticsWorkspaceCappingDailyQuotaGb int = -1
 param logAnalyticsWorkspaceRetentionInDays int = 30
 param logAnalyticsWorkspaceSkuName string = 'PerGB2018'
 
+@allowed([
+  'NIST'
+  'IL5' // Gov cloud only, trying to deploy IL5 in AzureCloud will switch to NIST
+  'CMMC'
+  ''
+])
+@description('Built-in policy assignments to assign, default is none. [NIST/IL5/CMMC] IL5 is only availalbe for GOV cloud and will switch to NIST if tried in AzureCloud.')
+param policy string = ''
+
 param tags object = {
   'resourcePrefix': resourcePrefix
 }