feat: sixDotOne (#1115)

## This PR fixes/adds/changes/removes Latest policy refresh. See https://github.com/Azure/terraform-azurerm-caf-enterprise-scale/milestone/13 ## Testing Evidence Please provide any testing evidence to show that your Pull Request works/fixes as described and planned (include screenshots, if appropriate). ## As part of this Pull Request I have - [ ] Checked for duplicate [Pull Requests](https://github.com/Azure/terraform-azurerm-caf-enterprise-scale/pulls) - [ ] Associated it with relevant [issues](https://github.com/Azure/terraform-azurerm-caf-enterprise-scale/issues), for tracking and closure. - [ ] Ensured my code/branch is up-to-date with the latest changes in the `main` [branch](https://github.com/Azure/terraform-azurerm-caf-enterprise-scale/tree/main) - [ ] Performed testing and provided evidence. - [ ] Updated relevant and associated documentation. --------- Co-authored-by: cae-pr-creator[bot] <126156663+cae-pr-creator[bot]@users.noreply.github.com> Co-authored-by: github-actions <[email protected]> Co-authored-by: Nicolas Neunert <[email protected]> Co-authored-by: paul-e-martin <[email protected]>
Azure · Sep 2, 2024 · dc0c89d · dc0c89d
1 parent ea21355
commit dc0c89d
Show file tree

Hide file tree

Showing 20 changed files with 220 additions and 70 deletions.
diff --git a/README.md b/README.md
@@ -654,11 +654,14 @@ object({
       log_analytics = optional(object({
         enabled = optional(bool, true)
         config = optional(object({
-          retention_in_days          = optional(number, 30)
-          enable_monitoring_for_vm   = optional(bool, true)
-          enable_monitoring_for_vmss = optional(bool, true)
-          enable_sentinel            = optional(bool, true)
-          enable_change_tracking     = optional(bool, true)
+          retention_in_days                      = optional(number, 30)
+          enable_monitoring_for_vm               = optional(bool, true)
+          enable_monitoring_for_vmss             = optional(bool, true)
+          enable_sentinel                        = optional(bool, true)
+          enable_change_tracking                 = optional(bool, true)
+          enable_solution_for_vm_insights        = optional(bool, true)
+          enable_solution_for_container_insights = optional(bool, true)
+          sentinel_customer_managed_key_enabled  = optional(bool, false) # not used at this time
         }), {})
       }), {})
       security_center = optional(object({
@@ -1103,6 +1106,8 @@ The following resources are used by this module:
 - [azurerm_resource_group.connectivity](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group) (resource)
 - [azurerm_resource_group.management](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group) (resource)
 - [azurerm_resource_group.virtual_wan](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group) (resource)
+- [azurerm_role_assignment.ama_managed_identity_operator](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
+- [azurerm_role_assignment.ama_reader](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
 - [azurerm_role_assignment.enterprise_scale](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
 - [azurerm_role_assignment.policy_assignment](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
 - [azurerm_role_assignment.private_dns_zone_contributor_connectivity](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)

diff --git a/locals.management.tf b/locals.management.tf
@@ -66,3 +66,11 @@ locals {
     if resource.managed_by_module
   }
 }
+
+# locals {
+#   azapi_sentinel_onboarding = {
+#     for resource in module.management_resources.configuration.azapi_sentinel_onboarding :
+#     resource.resource_id => resource
+#     if resource.managed_by_module
+#   }
+# }
diff --git a/locals.role_assignments.tf b/locals.role_assignments.tf
@@ -44,4 +44,5 @@ locals {
 
 locals {
   connectivity_mg_exists = length([for k, v in local.es_landing_zones_map : v if(v.id == "${var.root_id}-connectivity")]) > 0
-}
+  platform_mg_exists     = length([for k, v in local.es_landing_zones_map : v if(v.id == "${var.root_id}-platform")]) > 0
+}
diff --git a/main.tf b/main.tf
@@ -75,12 +75,13 @@ module "connectivity_resources" {
   tags     = local.connectivity_resources_tags
 
   # Optional input variables (advanced configuration)
-  resource_prefix                           = lookup(local.connectivity_resources_advanced, "resource_prefix", local.empty_string)
-  resource_suffix                           = lookup(local.connectivity_resources_advanced, "resource_suffix", local.empty_string)
-  existing_ddos_protection_plan_resource_id = lookup(local.connectivity_resources_advanced, "existing_ddos_protection_plan_resource_id", local.empty_string)
-  existing_virtual_wan_resource_id          = lookup(local.connectivity_resources_advanced, "existing_virtual_wan_resource_id", local.empty_string)
-  existing_virtual_wan_resource_group_name  = lookup(local.connectivity_resources_advanced, "existing_virtual_wan_resource_group_name", local.empty_string)
-  resource_group_per_virtual_hub_location   = lookup(local.connectivity_resources_advanced, "resource_group_per_virtual_hub_location", false)
-  custom_azure_backup_geo_codes             = lookup(local.connectivity_resources_advanced, "custom_azure_backup_geo_codes", local.empty_map)
-  custom_settings_by_resource_type          = lookup(local.connectivity_resources_advanced, "custom_settings_by_resource_type", local.empty_map)
+  resource_prefix                                 = lookup(local.connectivity_resources_advanced, "resource_prefix", local.empty_string)
+  resource_suffix                                 = lookup(local.connectivity_resources_advanced, "resource_suffix", local.empty_string)
+  existing_ddos_protection_plan_resource_id       = lookup(local.connectivity_resources_advanced, "existing_ddos_protection_plan_resource_id", local.empty_string)
+  existing_virtual_wan_resource_id                = lookup(local.connectivity_resources_advanced, "existing_virtual_wan_resource_id", local.empty_string)
+  existing_virtual_wan_resource_group_name        = lookup(local.connectivity_resources_advanced, "existing_virtual_wan_resource_group_name", local.empty_string)
+  resource_group_per_virtual_hub_location         = lookup(local.connectivity_resources_advanced, "resource_group_per_virtual_hub_location", false)
+  custom_azure_backup_geo_codes                   = lookup(local.connectivity_resources_advanced, "custom_azure_backup_geo_codes", local.empty_map)
+  custom_privatelink_azurestaticapps_partitionids = lookup(local.connectivity_resources_advanced, "custom_privatelink_azurestaticapps_partitionids", null)
+  custom_settings_by_resource_type                = lookup(local.connectivity_resources_advanced, "custom_settings_by_resource_type", local.empty_map)
 }
diff --git a/...es/lib/policy_set_definitions/policy_set_definition_es_deploy_private_dns_zones.tmpl.json b/...es/lib/policy_set_definitions/policy_set_definition_es_deploy_private_dns_zones.tmpl.json
@@ -1430,13 +1430,13 @@
         "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-Arc",
         "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/55c4db33-97b0-437b-8469-c4f4498f5df9",
         "parameters": {
-          "privateDnsZoneIdForGuestConfiguration": {
+          "privateDnsZoneIDForGuestConfiguration": {
             "value": "[parameters('azureArcGuestconfigurationPrivateDnsZoneId')]"
           },
-          "privateDnsZoneIdForHybridResourceProvider": {
+          "privateDnsZoneIDForHybridResourceProvider": {
             "value": "[parameters('azureArcHybridResourceProviderPrivateDnsZoneId')]"
           },
-          "privateDnsZoneIdForKubernetesConfiguration": {
+          "privateDnsZoneIDForKubernetesConfiguration": {
             "value": "[parameters('azureArcKubernetesConfigurationPrivateDnsZoneId')]"
           },
           "effect": {

diff --git a/...s/archetypes/lib/policy_set_definitions/policy_set_definition_es_enforce_backup.tmpl.json b/...s/archetypes/lib/policy_set_definitions/policy_set_definition_es_enforce_backup.tmpl.json
@@ -63,7 +63,7 @@
           "effect": {
             "value": "[parameters('effect')]"
           },
-          "CheckLockedImmutabiltyOnly": {
+          "checkLockedImmutabiltyOnly": {
             "value": "[parameters('checkLockedImmutabilityOnly')]"
           }
         },

diff --git a/...lib/policy_set_definitions/policy_set_definition_es_enforce_guardrails_keyvault.tmpl.json b/...lib/policy_set_definitions/policy_set_definition_es_enforce_guardrails_keyvault.tmpl.json
@@ -8,7 +8,7 @@
     "displayName": "Enforce recommended guardrails for Azure Key Vault",
     "description": "Enforce recommended guardrails for Azure Key Vault.",
     "metadata": {
-      "version": "2.0.0",
+      "version": "2.1.0",
       "category": "Key Vault",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -236,8 +236,11 @@
         "type": "string",
         "defaultValue": "Disabled",
         "allowedValues": [
+          "audit",
           "Audit",
+          "deny",
           "Deny",
+          "disabled",
           "Disabled"
         ]
       },

diff --git a/...b/policy_set_definitions/policy_set_definition_es_enforce_guardrails_kubernetes.tmpl.json b/...b/policy_set_definitions/policy_set_definition_es_enforce_guardrails_kubernetes.tmpl.json
@@ -8,7 +8,7 @@
     "displayName": "Enforce recommended guardrails for Kubernetes",
     "description": "This policy initiative is a group of policies that ensures Kubernetes is compliant per regulated Landing Zones.",
     "metadata": {
-      "version": "1.0.0",
+      "version": "1.1.0",
       "category": "Kubernetes",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -81,26 +81,35 @@
         "type": "string",
         "defaultValue": "Deny",
         "allowedValues": [
+          "audit",
           "Audit",
+          "deny",
           "Deny",
+          "disabled",
           "Disabled"
         ]
       },
       "aksPrivEscalation": {
         "type": "string",
         "defaultValue": "Deny",
         "allowedValues": [
+          "audit",
           "Audit",
+          "deny",
           "Deny",
+          "disabled",
           "Disabled"
         ]
       },
       "aksAllowedCapabilities": {
         "type": "string",
         "defaultValue": "Deny",
         "allowedValues": [
+          "audit",
           "Audit",
+          "deny",
           "Deny",
+          "disabled",
           "Disabled"
         ]
       },
@@ -117,17 +126,23 @@
         "type": "string",
         "defaultValue": "Deny",
         "allowedValues": [
+          "audit",
           "Audit",
+          "deny",
           "Deny",
+          "disabled",
           "Disabled"
         ]
       },
       "aksDefaultNamespace": {
         "type": "string",
         "defaultValue": "Deny",
         "allowedValues": [
+          "audit",
           "Audit",
+          "deny",
           "Deny",
+          "disabled",
           "Disabled"
         ]
       },
@@ -144,8 +159,11 @@
         "type": "string",
         "defaultValue": "Deny",
         "allowedValues": [
+          "audit",
           "Audit",
+          "deny",
           "Deny",
+          "disabled",
           "Disabled"
         ]
       },

diff --git a/.../lib/policy_set_definitions/policy_set_definition_es_enforce_guardrails_network.tmpl.json b/.../lib/policy_set_definitions/policy_set_definition_es_enforce_guardrails_network.tmpl.json
@@ -8,7 +8,7 @@
     "displayName": "Enforce recommended guardrails for Network and Networking services",
     "description": "This policy initiative is a group of policies that ensures Network and Networking services are compliant per regulated Landing Zones.",
     "metadata": {
-      "version": "1.0.0",
+      "version": "1.1.0",
       "category": "Network",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -56,7 +56,12 @@
       },
       "vnetModifyDdos": {
         "type": "string",
-        "defaultValue": "Modify"
+        "defaultValue": "Modify",
+        "allowedValues": [
+          "Audit",
+          "Modify",
+          "Disabled"
+        ]
       },
       "ddosPlanResourceId": {
         "type": "string",
@@ -229,9 +234,8 @@
         "type": "string",
         "defaultValue": "Deny",
         "allowedValues": [
-          "Audit",
-          "Deny",
-          "Disabled"
+          "Allow",
+          "Deny"
         ]
       },
       "modifyNsgRuleProtocol": {

diff --git a/.../lib/policy_set_definitions/policy_set_definition_es_enforce_guardrails_synapse.tmpl.json b/.../lib/policy_set_definitions/policy_set_definition_es_enforce_guardrails_synapse.tmpl.json
@@ -8,7 +8,7 @@
     "displayName": "Enforce recommended guardrails for Synapse workspaces",
     "description": "This policy initiative is a group of policies that ensures Synapse workspaces is compliant per regulated Landing Zones.",
     "metadata": {
-      "version": "1.0.0",
+      "version": "1.1.0",
       "category": "Synapse",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -65,7 +65,6 @@
         "defaultValue": "Audit",
         "allowedValues": [
           "Audit",
-          "Deny",
           "Disabled"
         ]
       },

diff --git a/modules/connectivity/README.md b/modules/connectivity/README.md
@@ -49,6 +49,25 @@ Type: `map(string)`
 
 Default: `{}`
 
+### <a name="input_custom_privatelink_azurestaticapps_partitionids"></a> [custom\_privatelink\_azurestaticapps\_partitionids](#input\_custom\_privatelink\_azurestaticapps\_partitionids)
+
+Description: As a uncertanty in the partition id for the azure static web app, this variable is used to specify the partition ids deployed for the azure static web app private DNS zones.  
+For more information, please refer to: https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns#web and https://learn.microsoft.com/en-us/azure/static-web-apps/private-endpoint
+
+Type: `list(number)`
+
+Default:
+
+```json
+[
+  1,
+  2,
+  3,
+  4,
+  5
+]
+```
+
 ### <a name="input_custom_settings_by_resource_type"></a> [custom\_settings\_by\_resource\_type](#input\_custom\_settings\_by\_resource\_type)
 
 Description: If specified, allows full customization of common settings for all resources (by type) deployed by this module.