From 6afb12bad7075b84b43a1e5370d557a7a3ba7313 Mon Sep 17 00:00:00 2001
From: erjosito <9462396+erjosito@users.noreply.github.com>
Date: Mon, 12 Aug 2024 16:29:04 +0000
Subject: [PATCH] [create-pull-request] automated change
---
checklists-ext/fullwaf_checklist.en.json | 1780 +-
checklists/azure_storage_checklist.en.json | 1128 +-
checklists/azure_storage_checklist.es.json | 566 +
checklists/azure_storage_checklist.ja.json | 566 +
checklists/azure_storage_checklist.ko.json | 566 +
checklists/azure_storage_checklist.pt.json | 566 +
.../azure_storage_checklist.zh-Hant.json | 566 +
checklists/checklist.en.master.json | 19592 +++++++++-------
checklists/waf_checklist.en.json | 1780 +-
checklists/waf_checklist.es.json | 434 +-
checklists/waf_checklist.ja.json | 434 +-
checklists/waf_checklist.ko.json | 434 +-
checklists/waf_checklist.pt.json | 434 +-
checklists/waf_checklist.zh-Hant.json | 434 +-
.../macrofree/azure_storage_checklist.en.xlsx | Bin 0 -> 26066 bytes
.../macrofree/azure_storage_checklist.es.xlsx | Bin 0 -> 26859 bytes
.../macrofree/azure_storage_checklist.ja.xlsx | Bin 0 -> 28159 bytes
.../macrofree/azure_storage_checklist.ko.xlsx | Bin 0 -> 27646 bytes
.../macrofree/azure_storage_checklist.pt.xlsx | Bin 0 -> 26768 bytes
.../azure_storage_checklist.zh-Hant.xlsx | Bin 0 -> 27123 bytes
.../macrofree/checklist.en.master.xlsx | Bin 439831 -> 476940 bytes
spreadsheet/macrofree/waf_checklist.en.xlsx | Bin 176673 -> 201186 bytes
spreadsheet/macrofree/waf_checklist.es.xlsx | Bin 187767 -> 193873 bytes
spreadsheet/macrofree/waf_checklist.ja.xlsx | Bin 204812 -> 213921 bytes
spreadsheet/macrofree/waf_checklist.ko.xlsx | Bin 198519 -> 206406 bytes
spreadsheet/macrofree/waf_checklist.pt.xlsx | Bin 187869 -> 195071 bytes
.../macrofree/waf_checklist.zh-Hant.xlsx | Bin 193318 -> 200124 bytes
.../alz_checklist.en_network_counters.json | 462 +-
...hecklist.en_network_counters_template.json | 2 +-
.../alz_checklist.en_network_tabcounters.json | 1050 +-
...klist.en_network_tabcounters_template.json | 2 +-
.../alz_checklist.en_network_workbook.json | 480 +-
...hecklist.en_network_workbook_template.json | 2 +-
...hecklist.en_network_counters_workbook.json | 212 +-
...en_network_counters_workbook_template.json | 2 +-
...elivery_checklist.en_network_workbook.json | 140 +-
...hecklist.en_network_workbook_template.json | 2 +-
...torage_checklist.en_counters_workbook.json | 536 +
...ecklist.en_counters_workbook_template.json | 57 +
.../azure_storage_checklist.en_workbook.json | 295 +
...torage_checklist.en_workbook_template.json | 57 +
41 files changed, 22801 insertions(+), 9778 deletions(-)
create mode 100644 checklists/azure_storage_checklist.es.json
create mode 100644 checklists/azure_storage_checklist.ja.json
create mode 100644 checklists/azure_storage_checklist.ko.json
create mode 100644 checklists/azure_storage_checklist.pt.json
create mode 100644 checklists/azure_storage_checklist.zh-Hant.json
create mode 100644 spreadsheet/macrofree/azure_storage_checklist.en.xlsx
create mode 100644 spreadsheet/macrofree/azure_storage_checklist.es.xlsx
create mode 100644 spreadsheet/macrofree/azure_storage_checklist.ja.xlsx
create mode 100644 spreadsheet/macrofree/azure_storage_checklist.ko.xlsx
create mode 100644 spreadsheet/macrofree/azure_storage_checklist.pt.xlsx
create mode 100644 spreadsheet/macrofree/azure_storage_checklist.zh-Hant.xlsx
create mode 100644 workbooks/azure_storage_checklist.en_counters_workbook.json
create mode 100644 workbooks/azure_storage_checklist.en_counters_workbook_template.json
create mode 100644 workbooks/azure_storage_checklist.en_workbook.json
create mode 100644 workbooks/azure_storage_checklist.en_workbook_template.json
diff --git a/checklists-ext/fullwaf_checklist.en.json b/checklists-ext/fullwaf_checklist.en.json
index c9bd293fb..ea9c41ce6 100644
--- a/checklists-ext/fullwaf_checklist.en.json
+++ b/checklists-ext/fullwaf_checklist.en.json
@@ -1,5 +1,1759 @@
{
"items": [
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.",
+ "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Entra",
+ "severity": "Low",
+ "text": "Use Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants.",
+ "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Use Azure Lighthouse for Multi-Tenant Management with the same IDs.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Entra",
+ "severity": "High",
+ "text": "If you give a partner access to administer your tenant, use Azure Lighthouse.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
+ "waf": "Cost"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "348ef254-c27d-442e-abba-c7571559ab91",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
+ "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Enforce Microsoft Entra ID Conditional Access policies for any user with rights to Azure environments.",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
+ "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Enforce multi-factor authentication for any user with rights to the Azure environments.",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "If planning to switch from Active Directory Domain Services to Entra domain services, evaluate the compatibility of all workloads.",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.",
+ "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
+ "waf": "Reliability"
+ },
+ {
+ "ammp": true,
+ "checklist": "Azure Landing Zone Review",
+ "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "35037e68-9349-4c15-b371-228514f4cdff",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Do not use on-premises synced accounts for Microsoft Entra ID role assignments, unless you have a scenario that specifically requires it.",
+ "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "When using Microsoft Entra ID Application Proxy to give remote users access to applications, manage it as a Platform resource as you can only have one instance per tenant.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "Use a hub-and-spoke network topology for network scenarios that require maximum flexibility.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Deploy shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS services.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Cost"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Use a DDoS Network or IP protection plan for all public IP addresses in application landing zones.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
+ "service": "NVA",
+ "severity": "Medium",
+ "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
+ "service": "ExpressRoute",
+ "severity": "Low",
+ "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualHubs",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
+ "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
+ "service": "ARS",
+ "severity": "Low",
+ "text": "If using Route Server, use a /27 prefix for the Route Server subnet.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
+ "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000).",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
+ "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "Limit the number of routes per route table to 400.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
+ "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
+ "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
+ "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16).",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
+ "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Do not use overlapping IP address ranges for production and disaster recovery sites.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
+ "service": "DNS",
+ "severity": "Medium",
+ "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
+ "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
+ "service": "DNS",
+ "severity": "Medium",
+ "text": "For environments where name resolution across Azure and on-premises is required and there is no existing enterprise DNS service like Active Directory, use Azure DNS Private Resolver to route DNS requests to Azure or to on-premises DNS servers.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
+ "service": "DNS",
+ "severity": "Low",
+ "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "614658d3-558f-4d77-849b-821112df27ee",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
+ "service": "DNS",
+ "severity": "High",
+ "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
+ "service": "Bastion",
+ "severity": "Medium",
+ "text": "Use Azure Bastion to securely connect to your network.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
+ "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
+ "service": "Bastion",
+ "severity": "Medium",
+ "text": "Use Azure Bastion in a subnet /26 or larger.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "WAF",
+ "severity": "Medium",
+ "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
+ "severity": "Low",
+ "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
+ "severity": "High",
+ "text": "When WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Plan for how to manage your network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
+ "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
+ "service": "Policy",
+ "severity": "High",
+ "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines. Use exclusions if public IPs are needed on specific VMs.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Use ExpressRoute as the primary connection to Azure. Use VPNs as a source of backup connectivity.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.",
+ "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "When you use multiple ExpressRoute circuits or multiple on-prem locations, use BGP attributes to optimize routing.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
+ "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
+ "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
+ "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
+ "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
+ "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
+ "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
+ "service": "VPN",
+ "severity": "Medium",
+ "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
+ "service": "VPN",
+ "severity": "Medium",
+ "text": "Use redundant VPN appliances on-premises (active/active or active/passive).",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
+ "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
+ "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Use ExpressRoute circuits from different peering locations for redundancy.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Use site-to-site VPN as failover of ExpressRoute, if only using a single ExpressRoute circuit.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
+ "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d581a947-69a2-4783-942e-9df3664324c8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
+ "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Do not use ExpressRoute circuits for VNet-to-VNet communication.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "service": "N/A",
+ "severity": "Low",
+ "text": "Do not send Azure traffic to hybrid locations for inspection. Instead, follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network.",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
+ "link": "https://learn.microsoft.com/azure/firewall/overview",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
+ "service": "Firewall",
+ "severity": "Low",
+ "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
+ "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
+ "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
+ "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Use Azure Firewall Premium to enable additional security features.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
+ "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
+ "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
+ "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
+ "service": "Firewall",
+ "severity": "Important",
+ "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
+ "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Use a /26 prefix for your Azure Firewall subnets.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
+ "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Use IP Groups or IP prefixes to reduce number of IP table rules.",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
+ "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Do not use wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
+ "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "346840b8-1064-496e-8396-4b1340172d52",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "If you are using Azure Firewall Premium, enable TLS Inspection.",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
+ "service": "Firewall",
+ "severity": "Low",
+ "text": "Use web categories to allow or deny outbound access to specific topics.",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
+ "link": "https://learn.microsoft.com/azure/firewall/dns-details",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Enable Azure Firewall DNS proxy configuration.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
+ "service": "Firewall",
+ "severity": "Low",
+ "text": "Implement backups for your firewall rules",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "AppGW",
+ "severity": "High",
+ "text": "Do not disrupt control-plane communication for Azure PaaS services injected into a virtual networks, such as with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
+ "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
+ "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Don't enable virtual network service endpoints by default on all subnets.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
+ "link": "azure/private-link/inspect-traffic-with-azure-firewall",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Use at least a /27 prefix for your Gateway subnets.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
+ "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
+ "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
+ "service": "NSG",
+ "severity": "High",
+ "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
+ "service": "NSG",
+ "severity": "Medium",
+ "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "NSG",
+ "severity": "Medium",
+ "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
+ "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
+ "service": "NSG",
+ "severity": "Medium",
+ "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
+ "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "NSG",
+ "severity": "Medium",
+ "text": "Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules.",
+ "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Use Virtual WAN if your scenario is explicitly described in the list of Virtual WAN routing designs.",
+ "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Ensure that your virtual WAN network architecture aligns to an identified architecture scenario.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Do not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Configure label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "9c75dfef-573c-461c-a698-68598595581a",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
+ "service": "VWAN",
+ "severity": "High",
+ "text": "Assign at least a /23 prefix to virtual hubs to ensure enough IP space is available.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "High",
+ "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "High",
+ "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "43334f24-9116-4341-a2ba-527526944008",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
+ "service": "Policy",
+ "severity": "Low",
+ "text": "Use Azure Policy to control which services users can provision at the subscription/management group level.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "High",
+ "text": "Use built-in policies where possible to minimize operational overhead.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.",
+ "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "19048384-5c98-46cb-8913-156a12476e49",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
+ "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "If any data sovereignty requirements exist, Azure Policies should be deployed to enforce them.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "For Sovereign Landing Zone, deploy sovereignty policy baseline and assign at correct management group level.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "For Sovereign Landing Zone, document Sovereign Control objectives to policy mapping.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "For Sovereign Landing Zone, ensure process is in place for management of 'Sovereign Control objectives to policy mapping'.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Monitor",
+ "severity": "High",
+ "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
+ "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/networkWatchers",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "90483845-c986-4cb2-a131-56a12476e49f",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Network Watcher",
+ "severity": "Medium",
+ "text": "Use Network Watcher to proactively monitor traffic flows.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "Use Azure Monitor Logs for insights and reporting.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "Use Azure Monitor alerts for the generation of operational alerts.",
+ "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Backup",
+ "severity": "Low",
+ "text": "When using Azure Backup, use the correct backup types (GRS, ZRS & LRS) for your backup, as the default setting is GRS.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Use Azure guest policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Use Azure Policy's guest configuration features to audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.",
+ "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Monitor VM security configuration drift via Azure Policy.",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.",
+ "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "Backup",
+ "severity": "Medium",
+ "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "WAF",
+ "severity": "High",
+ "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.",
+ "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "WAF",
+ "severity": "Medium",
+ "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.",
+ "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5017f154-e3ab-4369-9829-e7e316183687",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "Key Vault",
+ "severity": "High",
+ "text": "Use Azure Key Vault to store your secrets and credentials.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
+ "guid": "a0477a20-9945-4bda-9333-4f2491163418",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "913156a1-2476-4e49-b541-acdce979377b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Establish an automated process for key and certificate rotation.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Use an Azure Key Vault per application per environment per region.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
+ "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.",
+ "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "09945bda-4333-44f2-9911-634182ba5275",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
+ "service": "Defender",
+ "severity": "High",
+ "text": "Enable Defender Cloud Security Posture Management for all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
+ "service": "Defender",
+ "severity": "High",
+ "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
+ "service": "Defender",
+ "severity": "High",
+ "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
+ "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
+ "service": "VM",
+ "severity": "High",
+ "text": "Enable Endpoint Protection on IaaS Servers.",
+ "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
+ "link": "https://learn.microsoft.com/azure/security-center/",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.",
+ "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
+ "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "For Sovereign Landing Zone, enable transparancy logs on the Entra ID tenant.",
+ "waf": "Reliability"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "For Sovereign Landing Zone, enable customer Lockbox on the Entra ID tenant.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Storage",
+ "severity": "High",
+ "text": "Enable secure transfer to storage accounts.",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
+ "service": "Storage",
+ "severity": "High",
+ "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
+ "service": "Key Vault",
+ "severity": "High",
+ "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
+ "waf": "Operations"
+ },
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
@@ -2476,12 +4230,24 @@
{
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Storage Review Checklist",
- "description": "AAD tokens should be favored over shared access signatures, wherever possible",
+ "description": ". Enforcing the latest TLS version will reject request from clients using the older version. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Storage",
+ "severity": "High",
+ "text": "Enforce the latest TLS version for a storage account",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Microsoft Entra ID tokens should be favored over shared access signatures, wherever possible",
"guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
"link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
"service": "Storage",
"severity": "High",
- "text": "Use Azure Active Directory (Azure AD) tokens for blob access",
+ "text": "Use Microsoft Entra ID tokens for blob access",
"waf": "Reliability"
},
{
@@ -2508,12 +4274,13 @@
{
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Storage Review Checklist",
- "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on AAD authentication makes it easier to tie storage access to a user. ",
+ "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on Entra ID authentication makes it easier to tie storage access to a user. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
"guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
"link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
"service": "Storage",
"severity": "High",
- "text": "Consider disabling storage account keys, so that only AAD access (and user delegation SAS) is supported.",
+ "text": "Consider disabling storage account keys, so that only Microsoft Entra ID access (and user delegation SAS) is supported.",
"waf": "Reliability"
},
{
@@ -2691,11 +4458,12 @@
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Storage Review Checklist",
"description": "Leverage Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) to find storage accounts which allow anonymous blob access.",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
"guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
"link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
"service": "Storage",
"severity": "High",
- "text": "Consider whether public blob access is needed, or whether it can be disabled for certain storage accounts. ",
+ "text": "Consider whether public blob anonymous access is needed, or whether it can be disabled for certain storage accounts. ",
"waf": "Reliability"
},
{
@@ -24305,7 +26073,7 @@
],
"metadata": {
"name": "WAF checklist",
- "timestamp": "August 08, 2024"
+ "timestamp": "August 12, 2024"
},
"severities": [
{
diff --git a/checklists/azure_storage_checklist.en.json b/checklists/azure_storage_checklist.en.json
index 114601702..3d751716f 100644
--- a/checklists/azure_storage_checklist.en.json
+++ b/checklists/azure_storage_checklist.en.json
@@ -1,566 +1,566 @@
{
- "items": [
- {
- "category": "Security",
- "subcategory": " Overview",
- "text": "Consider the 'Azure security baseline for storage'",
- "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
- "id": "A01.01",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline"
- },
- {
- "category": "Security",
- "subcategory": "Networking",
- "text": "Consider using private endpoints for Azure Storage",
- "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
- "id": "A02.01",
- "severity": "High",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints"
- },
- {
- "category": "Security",
- "subcategory": "Governance",
- "text": "Ensure older storage accounts are not using 'classic deployment model'",
- "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
- "id": "A03.01",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts"
- },
- {
- "category": "Security",
- "subcategory": "Governance",
- "text": "Enable Microsoft Defender for all of your storage accounts",
- "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
- "id": "A03.02",
- "severity": "High",
- "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure"
- },
- {
- "category": "Security",
- "subcategory": "Data Availability",
- "text": "Enable 'soft delete' for blobs",
- "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
- "id": "A04.01",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview"
- },
- {
- "category": "Security",
- "subcategory": "Confidentiality",
- "text": "Disable 'soft delete' for blobs",
- "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
- "id": "A05.01",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable"
- },
- {
- "category": "Security",
- "subcategory": "Data Availability",
- "text": "Enable 'soft delete' for containers",
- "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
- "id": "A06.01",
- "severity": "High",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview"
- },
- {
- "category": "Security",
- "subcategory": "Confidentiality",
- "text": "Disable 'soft delete' for containers",
- "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
- "id": "A07.01",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable"
- },
- {
- "category": "Security",
- "subcategory": "Data Availability",
- "text": "Enable resource locks on storage accounts",
- "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
- "id": "A08.01",
- "severity": "High",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource"
- },
- {
- "category": "Security",
- "subcategory": "Data Availability, Compliance",
- "text": "Consider immutable blobs",
- "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
- "id": "A09.01",
- "severity": "High",
- "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview"
- },
- {
- "category": "Security",
- "subcategory": "Networking",
- "text": "Require HTTPS, i.e. disable port 80 on the storage account",
- "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
- "id": "A10.01",
- "severity": "High",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer"
- },
- {
- "category": "Security",
- "subcategory": "Networking",
- "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.",
- "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
- "id": "A10.02",
- "severity": "High",
- "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name"
- },
- {
- "category": "Security",
- "subcategory": "Networking",
- "text": "Limit shared access signature (SAS) tokens to HTTPS connections only",
- "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
- "id": "A10.03",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview"
- },
- {
- "category": "Security",
- "subcategory": "Networking",
- "text": "Enforce the latest TLS version for a storage account",
- "description": ". Enforcing the latest TLS version will reject request from clients using the older version. ",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
- "id": "A10.4",
- "severity": "High",
- "graph":"resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
- "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version"
- },
- {
- "category": "Security",
- "subcategory": "Identity and Access Management",
- "text": "Use Microsoft Entra ID tokens for blob access",
- "description": "Microsoft Entra ID tokens should be favored over shared access signatures, wherever possible",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
- "id": "A11.01",
- "severity": "High",
- "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access"
- },
- {
- "category": "Security",
- "subcategory": "Identity and Access Management",
- "text": "Least privilege in IaM permissions",
- "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
- "id": "A11.02",
- "severity": "Medium"
- },
- {
- "category": "Security",
- "subcategory": "Identity and Access Management",
- "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.",
- "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
- "id": "A11.03",
- "severity": "High",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas"
- },
- {
- "category": "Security",
- "subcategory": "Identity and Access Management",
- "text": "Consider disabling storage account keys, so that only Microsoft Entra ID access (and user delegation SAS) is supported.",
- "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on Entra ID authentication makes it easier to tie storage access to a user. ",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
- "id": "A11.04",
- "severity": "High",
- "graph":"resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
- "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key"
- },
- {
- "category": "Security",
- "subcategory": "Monitoring",
- "text": "Consider using Azure Monitor to audit control plane operations on the storage account",
- "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
- "id": "A12.01",
- "severity": "High",
- "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity"
- },
- {
- "category": "Security",
- "subcategory": "Identity and Access Management",
- "text": "When using storage account keys, consider enabling a 'key expiration policy'",
- "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
- "id": "A13.01",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy"
- },
- {
- "category": "Security",
- "subcategory": "Identity and Access Management",
- "text": "Consider configuring an SAS expiration policy",
- "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
- "id": "A13.02",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy"
- },
- {
- "category": "Security",
- "subcategory": "Identity and Access Management",
- "text": "Consider linking SAS to a stored access policy",
- "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "id": "A13.03",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy"
- },
- {
- "category": "Security",
- "subcategory": "CI/CD",
- "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "id": "A14.01",
- "severity": "Medium",
- "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/"
- },
- {
- "category": "Security",
- "subcategory": "Identity and Access Management",
- "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)",
- "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "id": "A15.01",
- "severity": "High",
- "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys"
- },
- {
- "category": "Security",
- "subcategory": "Identity and Access Management",
- "text": "Strive for short validity periods for ad-hoc SAS",
- "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
- "id": "A15.02",
- "severity": "High",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature"
- },
- {
- "category": "Security",
- "subcategory": "Identity and Access Management",
- "text": "Apply a narrow scope to a SAS",
- "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
- "id": "A15.03",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature"
- },
- {
- "category": "Security",
- "subcategory": "Identity and Access Management",
- "text": "Consider scoping SAS to a specific client IP address, wherever possible",
- "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
- "id": "A15.04",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas"
- },
- {
- "category": "Security",
- "subcategory": "Identity and Access Management",
- "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ",
- "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
- "id": "A15.05",
- "severity": "Low"
- },
- {
- "category": "Security",
- "subcategory": "Identity and Access Management",
- "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.",
- "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
- "id": "A15.06",
- "severity": "High",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model"
- },
- {
- "category": "Security",
- "subcategory": "Identity and Access Management",
- "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
- "id": "A15.07",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization"
- },
- {
- "category": "Security",
- "subcategory": "Networking",
- "text": "Avoid overly broad CORS policies",
- "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
- "id": "A16.01",
- "severity": "High",
- "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services"
- },
- {
- "category": "Security",
- "subcategory": "Confidentiality and Encryption",
- "text": "Determine how data at rest should be encrypted. Understand the thread model for data.",
- "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
- "id": "A17.01",
- "severity": "High",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption"
- },
- {
- "category": "Security",
- "subcategory": "Confidentiality and Encryption",
- "text": "Determine which/if platform encryption should be used.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
- "id": "A17.02",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json"
- },
- {
- "category": "Security",
- "subcategory": "Confidentiality and Encryption",
- "text": "Determine which/if client-side encryption should be used.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
- "id": "A17.03",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys"
- },
- {
- "category": "Security",
- "subcategory": "Identity and Access Management",
- "text": "Consider whether public blob anonymous access is needed, or whether it can be disabled for certain storage accounts. ",
- "description": "Leverage Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) to find storage accounts which allow anonymous blob access.",
- "waf": "Security",
- "service": "Azure Storage",
- "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
- "id": "A18.01",
- "severity": "High",
- "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
- "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account"
- },
- {
- "category": "Operations Management",
- "subcategory": "Platform Version",
- "text": "Leverage a storagev2 account type for better performance and reliability",
- "waf": "Reliability",
- "service": "Azure Storage",
- "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
- "id": "B01.01",
- "severity": "High",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal"
- },
- {
- "category": "BC and DR",
- "subcategory": "Availablity",
- "text": "Leverage GRS, ZRS or GZRS storage for the highest availability",
- "waf": "Reliability",
- "service": "Azure Storage",
- "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
- "id": "C01.01",
- "severity": "High",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy"
- },
- {
- "category": "BC and DR",
- "subcategory": "Failover",
- "text": "For write operation after failover, use customer-Managed Failover ",
- "waf": "Reliability",
- "service": "Azure Storage",
- "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
- "id": "C01.02",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance"
- },
- {
- "category": "Operations Management",
- "subcategory": "Failover",
- "text": "Understand Microsoft-Managed Failover details",
- "waf": "Reliability",
- "service": "Azure Storage",
- "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
- "id": "C01.03",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover"
- },
- {
- "category": "Operations Management",
- "subcategory": "Data Protection",
- "text": "Enable Soft Delete",
- "waf": "Reliability",
- "service": "Azure Storage",
- "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
- "id": "C01.04",
- "severity": "Medium",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal"
+ "items": [
+ {
+ "category": "Security",
+ "subcategory": " Overview",
+ "text": "Consider the 'Azure security baseline for storage'",
+ "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "id": "A01.01",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Networking",
+ "text": "Consider using private endpoints for Azure Storage",
+ "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "id": "A02.01",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Governance",
+ "text": "Ensure older storage accounts are not using 'classic deployment model'",
+ "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "id": "A03.01",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Governance",
+ "text": "Enable Microsoft Defender for all of your storage accounts",
+ "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "id": "A03.02",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Data Availability",
+ "text": "Enable 'soft delete' for blobs",
+ "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "id": "A04.01",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Confidentiality",
+ "text": "Disable 'soft delete' for blobs",
+ "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "id": "A05.01",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Data Availability",
+ "text": "Enable 'soft delete' for containers",
+ "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "id": "A06.01",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Confidentiality",
+ "text": "Disable 'soft delete' for containers",
+ "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "id": "A07.01",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Data Availability",
+ "text": "Enable resource locks on storage accounts",
+ "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "id": "A08.01",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Data Availability, Compliance",
+ "text": "Consider immutable blobs",
+ "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "id": "A09.01",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Networking",
+ "text": "Require HTTPS, i.e. disable port 80 on the storage account",
+ "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "id": "A10.01",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Networking",
+ "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.",
+ "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "id": "A10.02",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Networking",
+ "text": "Limit shared access signature (SAS) tokens to HTTPS connections only",
+ "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "id": "A10.03",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Networking",
+ "text": "Enforce the latest TLS version for a storage account",
+ "description": ". Enforcing the latest TLS version will reject request from clients using the older version. ",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "id": "A10.4",
+ "severity": "High",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Identity and Access Management",
+ "text": "Use Microsoft Entra ID tokens for blob access",
+ "description": "Microsoft Entra ID tokens should be favored over shared access signatures, wherever possible",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "id": "A11.01",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Identity and Access Management",
+ "text": "Least privilege in IaM permissions",
+ "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "id": "A11.02",
+ "severity": "Medium"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Identity and Access Management",
+ "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.",
+ "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "id": "A11.03",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Identity and Access Management",
+ "text": "Consider disabling storage account keys, so that only Microsoft Entra ID access (and user delegation SAS) is supported.",
+ "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on Entra ID authentication makes it easier to tie storage access to a user. ",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "id": "A11.04",
+ "severity": "High",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Monitoring",
+ "text": "Consider using Azure Monitor to audit control plane operations on the storage account",
+ "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "id": "A12.01",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Identity and Access Management",
+ "text": "When using storage account keys, consider enabling a 'key expiration policy'",
+ "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "id": "A13.01",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Identity and Access Management",
+ "text": "Consider configuring an SAS expiration policy",
+ "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "id": "A13.02",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Identity and Access Management",
+ "text": "Consider linking SAS to a stored access policy",
+ "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "id": "A13.03",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy"
+ },
+ {
+ "category": "Security",
+ "subcategory": "CI/CD",
+ "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "id": "A14.01",
+ "severity": "Medium",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Identity and Access Management",
+ "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)",
+ "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "id": "A15.01",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Identity and Access Management",
+ "text": "Strive for short validity periods for ad-hoc SAS",
+ "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "id": "A15.02",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Identity and Access Management",
+ "text": "Apply a narrow scope to a SAS",
+ "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "id": "A15.03",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Identity and Access Management",
+ "text": "Consider scoping SAS to a specific client IP address, wherever possible",
+ "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "id": "A15.04",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Identity and Access Management",
+ "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ",
+ "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "id": "A15.05",
+ "severity": "Low"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Identity and Access Management",
+ "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.",
+ "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "id": "A15.06",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Identity and Access Management",
+ "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "id": "A15.07",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Networking",
+ "text": "Avoid overly broad CORS policies",
+ "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "id": "A16.01",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Confidentiality and Encryption",
+ "text": "Determine how data at rest should be encrypted. Understand the thread model for data.",
+ "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "id": "A17.01",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Confidentiality and Encryption",
+ "text": "Determine which/if platform encryption should be used.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "id": "A17.02",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Confidentiality and Encryption",
+ "text": "Determine which/if client-side encryption should be used.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "id": "A17.03",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys"
+ },
+ {
+ "category": "Security",
+ "subcategory": "Identity and Access Management",
+ "text": "Consider whether public blob anonymous access is needed, or whether it can be disabled for certain storage accounts. ",
+ "description": "Leverage Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) to find storage accounts which allow anonymous blob access.",
+ "waf": "Security",
+ "service": "Azure Storage",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "id": "A18.01",
+ "severity": "High",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account"
+ },
+ {
+ "category": "Operations Management",
+ "subcategory": "Platform Version",
+ "text": "Leverage a storagev2 account type for better performance and reliability",
+ "waf": "Reliability",
+ "service": "Azure Storage",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "id": "B01.01",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal"
+ },
+ {
+ "category": "BC and DR",
+ "subcategory": "Availablity",
+ "text": "Leverage GRS, ZRS or GZRS storage for the highest availability",
+ "waf": "Reliability",
+ "service": "Azure Storage",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "id": "C01.01",
+ "severity": "High",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy"
+ },
+ {
+ "category": "BC and DR",
+ "subcategory": "Failover",
+ "text": "For write operation after failover, use customer-Managed Failover ",
+ "waf": "Reliability",
+ "service": "Azure Storage",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "id": "C01.02",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance"
+ },
+ {
+ "category": "Operations Management",
+ "subcategory": "Failover",
+ "text": "Understand Microsoft-Managed Failover details",
+ "waf": "Reliability",
+ "service": "Azure Storage",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "id": "C01.03",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover"
+ },
+ {
+ "category": "Operations Management",
+ "subcategory": "Data Protection",
+ "text": "Enable Soft Delete",
+ "waf": "Reliability",
+ "service": "Azure Storage",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "id": "C01.04",
+ "severity": "Medium",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal"
+ }
+ ],
+ "categories": [
+ {
+ "name": "Identity and Access Management"
+ },
+ {
+ "name": "Network Topology and Connectivity"
+ },
+ {
+ "name": "BC and DR"
+ },
+ {
+ "name": "Governance and Security"
+ },
+ {
+ "name": "Cost Governance"
+ },
+ {
+ "name": "Operations Management"
+ },
+ {
+ "name": "Application Deployment"
+ },
+ {
+ "name": "Security"
+ }
+ ],
+ "waf": [
+ {
+ "name": "Reliability"
+ },
+ {
+ "name": "Security"
+ },
+ {
+ "name": "Cost"
+ },
+ {
+ "name": "Operations"
+ },
+ {
+ "name": "Performance"
+ }
+ ],
+ "yesno": [
+ {
+ "name": "Yes"
+ },
+ {
+ "name": "No"
+ }
+ ],
+ "status": [
+ {
+ "name": "Not verified",
+ "description": "This check has not been looked at yet"
+ },
+ {
+ "name": "Open",
+ "description": "There is an action item associated to this check"
+ },
+ {
+ "name": "Fulfilled",
+ "description": "This check has been verified, and there are no further action items associated to it"
+ },
+ {
+ "name": "Not required",
+ "description": "Recommendation understood, but not needed by current requirements"
+ },
+ {
+ "name": "N/A",
+ "description": "Not applicable for current design"
+ }
+ ],
+ "severities": [
+ {
+ "name": "High"
+ },
+ {
+ "name": "Medium"
+ },
+ {
+ "name": "Low"
+ }
+ ],
+ "metadata": {
+ "name": "Azure Storage Review Checklist",
+ "state": "Preview",
+ "waf": "all",
+ "timestamp": "August 12, 2024"
}
- ],
- "categories": [
- {
- "name": "Identity and Access Management"
- },
- {
- "name": "Network Topology and Connectivity"
- },
- {
- "name": "BC and DR"
- },
- {
- "name": "Governance and Security"
- },
- {
- "name": "Cost Governance"
- },
- {
- "name": "Operations Management"
- },
- {
- "name": "Application Deployment"
- },
- {
- "name": "Security"
- }
- ],
- "waf": [
- {
- "name": "Reliability"
- },
- {
- "name": "Security"
- },
- {
- "name": "Cost"
- },
- {
- "name": "Operations"
- },
- {
- "name": "Performance"
- }
- ],
- "yesno": [
- {
- "name": "Yes"
- },
- {
- "name": "No"
- }
- ],
- "status": [
- {
- "name": "Not verified",
- "description": "This check has not been looked at yet"
- },
- {
- "name": "Open",
- "description": "There is an action item associated to this check"
- },
- {
- "name": "Fulfilled",
- "description": "This check has been verified, and there are no further action items associated to it"
- },
- {
- "name": "Not required",
- "description": "Recommendation understood, but not needed by current requirements"
- },
- {
- "name": "N/A",
- "description": "Not applicable for current design"
- }
- ],
- "severities": [
- {
- "name": "High"
- },
- {
- "name": "Medium"
- },
- {
- "name": "Low"
- }
- ],
- "metadata": {
- "name": "Azure Storage Review Checklist",
- "state": "Preview",
- "waf": "all",
- "timestamp": "April 19, 2024"
- }
-}
+}
\ No newline at end of file
diff --git a/checklists/azure_storage_checklist.es.json b/checklists/azure_storage_checklist.es.json
new file mode 100644
index 000000000..b0c270576
--- /dev/null
+++ b/checklists/azure_storage_checklist.es.json
@@ -0,0 +1,566 @@
+{
+ "categories": [
+ {
+ "name": "Gestión de identidades y accesos"
+ },
+ {
+ "name": "Topología de red y conectividad"
+ },
+ {
+ "name": "BC y RD"
+ },
+ {
+ "name": "Gobernanza y seguridad"
+ },
+ {
+ "name": "Gobernanza de costos"
+ },
+ {
+ "name": "Gestión de Operaciones"
+ },
+ {
+ "name": "Implementación de aplicaciones"
+ },
+ {
+ "name": "Seguridad"
+ }
+ ],
+ "items": [
+ {
+ "category": "Seguridad",
+ "description": "Aplicación de las instrucciones del banco de pruebas de seguridad en la nube de Microsoft relacionadas con el almacenamiento",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "id": "A01.01",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": " Visión general",
+ "text": "Tenga en cuenta la \"Línea base de seguridad de Azure para el almacenamiento\"",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "De forma predeterminada, Azure Storage tiene una dirección IP pública y es accesible desde Internet. Los puntos de conexión privados permiten exponer de forma segura Azure Storage solo a los recursos de Azure Compute que necesitan acceso, lo que elimina la exposición a la Internet pública",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "id": "A02.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gestión de redes",
+ "text": "Considere la posibilidad de usar puntos de conexión privados para Azure Storage",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Las cuentas de almacenamiento recién creadas se crean mediante el modelo de implementación de ARM, de modo que RBAC, etcétera de auditoría, estén habilitados. Asegúrese de que no haya cuentas de almacenamiento antiguas con el modelo de implementación clásico en una suscripción",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "id": "A03.01",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Gobernanza",
+ "text": "Asegúrese de que las cuentas de almacenamiento más antiguas no usen el \"modelo de implementación clásica\"",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Aproveche Microsoft Defender para obtener información sobre actividades sospechosas y configuraciones incorrectas.",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "id": "A03.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gobernanza",
+ "text": "Habilitación de Microsoft Defender para todas las cuentas de almacenamiento",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "El mecanismo de eliminación temporal permite recuperar blobs eliminados accidentalmente.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "id": "A04.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Disponibilidad de datos",
+ "text": "Habilitación de la \"eliminación temporal\" para blobs",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Considere la posibilidad de deshabilitar selectivamente la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe asegurarse de que la información eliminada se elimine inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "id": "A05.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Confidencialidad",
+ "text": "Deshabilitación de la \"eliminación temporal\" para blobs",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "La eliminación temporal de contenedores permite recuperar un contenedor después de que se haya eliminado, por ejemplo, recuperarse de una operación de eliminación accidental.",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "id": "A06.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Disponibilidad de datos",
+ "text": "Habilitación de la \"eliminación temporal\" para contenedores",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Considere la posibilidad de deshabilitar selectivamente la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe asegurarse de que la información eliminada se elimine inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "id": "A07.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Confidencialidad",
+ "text": "Deshabilitar la \"eliminación temporal\" para contenedores",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Evita la eliminación accidental de una cuenta de almacenamiento, obligando al usuario a quitar primero el bloqueo de eliminación, antes de la eliminación",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "id": "A08.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Disponibilidad de datos",
+ "text": "Habilitación de bloqueos de recursos en cuentas de almacenamiento",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Considere la posibilidad de aplicar directivas de \"retención legal\" o \"retención basada en tiempo\" para los blobs, de modo que sea imposible eliminar el blob, el contenedor o la cuenta de almacenamiento. Tenga en cuenta que 'imposible' en realidad significa 'imposible'; una vez que una cuenta de almacenamiento contiene un blob inmutable, la única manera de \"deshacerse\" de esa cuenta de almacenamiento es cancelando la suscripción de Azure.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "id": "A09.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Disponibilidad de datos, cumplimiento",
+ "text": "Considere la posibilidad de blobs inmutables",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Considere la posibilidad de deshabilitar el acceso HTTP/80 no protegido a la cuenta de almacenamiento, de modo que todas las transferencias de datos estén cifradas, protegidas contra la integridad y el servidor esté autenticado. ",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "id": "A10.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gestión de redes",
+ "text": "Requerir HTTPS, es decir, deshabilitar el puerto 80 en la cuenta de almacenamiento",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Al configurar un dominio personalizado (nombre de host) en una cuenta de almacenamiento, compruebe si necesita TLS/HTTPS; si es así, es posible que tenga que colocar Azure CDN delante de la cuenta de almacenamiento.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "id": "A10.02",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gestión de redes",
+ "text": "Al aplicar HTTPS (deshabilitar HTTP), compruebe que no usa dominios personalizados (CNAME) para la cuenta de almacenamiento.",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Requerir HTTPS cuando un cliente usa un token de SAS para acceder a los datos de blob ayuda a minimizar el riesgo de pérdida de credenciales.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "id": "A10.03",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Gestión de redes",
+ "text": "Limitar los tokens de firma de acceso compartido (SAS) solo a las conexiones HTTPS",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": ". Al aplicar la versión más reciente de TLS, se rechazarán las solicitudes de los clientes que utilicen la versión anterior. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "id": "A10.4",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gestión de redes",
+ "text": "Aplicación de la versión más reciente de TLS para una cuenta de almacenamiento",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Los tokens de identificador de Microsoft Entra deben favorecerse sobre las firmas de acceso compartido, siempre que sea posible",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "id": "A11.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gestión de identidades y accesos",
+ "text": "Uso de tokens de identificador de Microsoft Entra para el acceso a blobs",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Al asignar un rol a un usuario, grupo o aplicación, conceda a esa entidad de seguridad solo los permisos necesarios para que pueda realizar sus tareas. Limitar el acceso a los recursos ayuda a evitar el uso indebido no intencionado y malintencionado de los datos.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "id": "A11.02",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Gestión de identidades y accesos",
+ "text": "Privilegio mínimo en los permisos de IaM",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Una SAS de delegación de usuarios está protegida con credenciales de Azure Active Directory (Azure AD) y también con los permisos especificados para la SAS. Una SAS de delegación de usuarios es análoga a una SAS de servicio en cuanto a su ámbito y función, pero ofrece ventajas de seguridad con respecto a la SAS de servicio. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "id": "A11.03",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gestión de identidades y accesos",
+ "text": "Al usar SAS, prefiera \"SAS de delegación de usuarios\" en lugar de SAS basada en clave de cuenta de almacenamiento.",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Las claves de la cuenta de almacenamiento ('claves compartidas') tienen muy pocas capacidades de auditoría. Si bien se puede monitorear quién o cuándo obtuvo una copia de las claves, una vez que las claves están en manos de varias personas, es imposible atribuir el uso a un usuario específico. Confiar únicamente en la autenticación de ID de Entra facilita la vinculación del acceso al almacenamiento de un usuario. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "id": "A11.04",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gestión de identidades y accesos",
+ "text": "Considere la posibilidad de deshabilitar las claves de la cuenta de almacenamiento, de modo que solo se admita el acceso a Microsoft Entra ID (y SAS de delegación de usuarios).",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Utilice los datos del registro de actividad para identificar \"cuándo\", \"quién\", \"qué\" y \"cómo\" se está viendo o cambiando la seguridad de la cuenta de almacenamiento (es decir, claves de cuenta de almacenamiento, directivas de acceso, etcétera).",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "id": "A12.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Monitorización",
+ "text": "Considere la posibilidad de usar Azure Monitor para auditar las operaciones del plano de control en la cuenta de almacenamiento",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Una política de caducidad de claves le permite establecer un recordatorio para la rotación de las claves de acceso de la cuenta. El recordatorio se muestra si ha transcurrido el intervalo especificado y las teclas aún no se han girado.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "id": "A13.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Gestión de identidades y accesos",
+ "text": "Al usar claves de cuenta de almacenamiento, considere la posibilidad de habilitar una \"directiva de expiración de claves\"",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Una directiva de expiración de SAS especifica un intervalo recomendado durante el cual la SAS es válida. Las directivas de caducidad de SAS se aplican a una SAS de servicio o a una SAS de cuenta. Cuando un usuario genera una SAS de servicio o una SAS de cuenta con un intervalo de validez mayor que el intervalo recomendado, verá una advertencia.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "id": "A13.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Gestión de identidades y accesos",
+ "text": "Considere la posibilidad de configurar una directiva de expiración de SAS",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Las directivas de acceso almacenadas ofrecen la opción de revocar los permisos de una SAS de servicio sin tener que volver a generar las claves de la cuenta de almacenamiento. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "id": "A13.03",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Gestión de identidades y accesos",
+ "text": "Considere la posibilidad de vincular SAS a una directiva de acceso almacenada",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "id": "A14.01",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "CI/CD",
+ "text": "Considere la posibilidad de configurar el repositorio de código fuente de la aplicación para detectar cadenas de conexión protegidas y claves de cuenta de almacenamiento.",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Lo ideal es que la aplicación use una identidad administrada para autenticarse en Azure Storage. Si eso no es posible, considere la posibilidad de tener la credencial de almacenamiento (cadena de conexión, clave de cuenta de almacenamiento, SAS, credencial de entidad de servicio) en Azure KeyVault o un servicio equivalente.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "id": "A15.01",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gestión de identidades y accesos",
+ "text": "Considere la posibilidad de almacenar cadenas de conexión en Azure KeyVault (en escenarios en los que las identidades administradas no son posibles)",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Utilice los tiempos de caducidad a corto plazo en una SAS de servicio SAS ad hoc o en una SAS de cuenta. De esta manera, incluso si una SAS se ve comprometida, solo es válida durante un corto período de tiempo. Esta práctica es especialmente importante si no puede hacer referencia a una política de acceso almacenada. Los tiempos de expiración a corto plazo también limitan la cantidad de datos que se pueden escribir en un blob al limitar el tiempo disponible para cargarlos en él.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "id": "A15.02",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gestión de identidades y accesos",
+ "text": "Esfuércese por períodos de validez cortos para SAS ad-hoc",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Al crear una SAS, sea lo más específico y restrictivo posible. Prefiera una SAS para un solo recurso y operación en lugar de una SAS que proporciona un acceso mucho más amplio.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "id": "A15.03",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Gestión de identidades y accesos",
+ "text": "Aplicación de un ámbito limitado a una SAS",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Una SAS puede incluir parámetros sobre las direcciones IP de cliente o los intervalos de direcciones que están autorizados a solicitar un recurso mediante la SAS. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "id": "A15.04",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Gestión de identidades y accesos",
+ "text": "Considere la posibilidad de definir el ámbito de SAS a una dirección IP de cliente específica, siempre que sea posible",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Una SAS no puede restringir la cantidad de datos que carga un cliente; Dado el modelo de precios de la cantidad de almacenamiento a lo largo del tiempo, podría tener sentido validar si los clientes cargaron contenidos malintencionados de gran tamaño.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "id": "A15.05",
+ "service": "Azure Storage",
+ "severity": "Bajo",
+ "subcategory": "Gestión de identidades y accesos",
+ "text": "Considere la posibilidad de comprobar los datos cargados, después de que los clientes hayan utilizado una SAS para cargar un archivo. ",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Al acceder al almacenamiento de blobs a través de SFTP mediante una \"cuenta de usuario local\", no se aplican los controles RBAC \"habituales\". El acceso a blobs a través de NFS o REST puede ser más restrictivo que el acceso SFTP. Desafortunadamente, a partir de principios de 2023, los usuarios locales son la única forma de administración de identidades que actualmente es compatible con el punto de conexión SFTP",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "id": "A15.06",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gestión de identidades y accesos",
+ "text": "SFTP: Limite la cantidad de \"usuarios locales\" para el acceso SFTP y audite si el acceso es necesario a lo largo del tiempo.",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "id": "A15.07",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Gestión de identidades y accesos",
+ "text": "SFTP: El punto de conexión SFTP no admite ACL similares a POSIX.",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "El almacenamiento es compatible con CORS (Cross-Origin Resource Sharing), es decir, una función HTTP que permite a las aplicaciones web de un dominio diferente aflojar la política del mismo origen. Al habilitar CORS, mantenga CorsRules con el mínimo privilegio.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "id": "A16.01",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gestión de redes",
+ "text": "Evite las políticas de CORS demasiado amplias",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Los datos en reposo siempre se cifran en el lado del servidor y, además, también pueden estar cifrados en el lado del cliente. El cifrado del lado del servidor puede producirse mediante una clave administrada por la plataforma (valor predeterminado) o una clave administrada por el cliente. El cifrado del lado cliente puede producirse haciendo que el cliente proporcione una clave de cifrado y descifrado por blob al almacenamiento de Azure o controlando completamente el cifrado en el lado cliente. por lo tanto, no depende en absoluto de Azure Storage para obtener garantías de confidencialidad.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "id": "A17.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Confidencialidad y encriptación",
+ "text": "Determine cómo se deben cifrar los datos en reposo. Comprender el modelo de subprocesos para los datos.",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "id": "A17.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Confidencialidad y encriptación",
+ "text": "Determine cuál o si se debe utilizar el cifrado de la plataforma.",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "id": "A17.03",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Confidencialidad y encriptación",
+ "text": "Determine qué cifrado del lado del cliente se debe usar, si se debe usar.",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Seguridad",
+ "description": "Aproveche el Explorador de Resource Graph (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) para buscar cuentas de almacenamiento que permitan el acceso anónimo a blobs.",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "id": "A18.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gestión de identidades y accesos",
+ "text": "Considere si es necesario el acceso anónimo de blob público o si se puede deshabilitar para determinadas cuentas de almacenamiento. ",
+ "waf": "Seguridad"
+ },
+ {
+ "category": "Gestión de Operaciones",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "id": "B01.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Versión de la plataforma",
+ "text": "Aproveche un tipo de cuenta storagev2 para mejorar el rendimiento y la confiabilidad",
+ "waf": "Fiabilidad"
+ },
+ {
+ "category": "BC y RD",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "id": "C01.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Disponibilidad",
+ "text": "Aproveche el almacenamiento GRS, ZRS o GZRS para obtener la máxima disponibilidad",
+ "waf": "Fiabilidad"
+ },
+ {
+ "category": "BC y RD",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "id": "C01.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Conmutación por error",
+ "text": "Para la operación de escritura después de la conmutación por error, use la conmutación por error administrada por el cliente ",
+ "waf": "Fiabilidad"
+ },
+ {
+ "category": "Gestión de Operaciones",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "id": "C01.03",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Conmutación por error",
+ "text": "Descripción de los detalles de la conmutación por error administrada por Microsoft",
+ "waf": "Fiabilidad"
+ },
+ {
+ "category": "Gestión de Operaciones",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "id": "C01.04",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "subcategory": "Protección de datos",
+ "text": "Habilitar eliminación temporal",
+ "waf": "Fiabilidad"
+ }
+ ],
+ "metadata": {
+ "name": "Azure Storage Review Checklist",
+ "state": "Preview",
+ "timestamp": "August 12, 2024",
+ "waf": "all"
+ },
+ "severities": [
+ {
+ "name": "Alto"
+ },
+ {
+ "name": "Medio"
+ },
+ {
+ "name": "Bajo"
+ }
+ ],
+ "status": [
+ {
+ "description": "Este control aún no se ha examinado",
+ "name": "No verificado"
+ },
+ {
+ "description": "Hay un elemento de acción asociado a esta comprobación",
+ "name": "Abrir"
+ },
+ {
+ "description": "Esta comprobación se ha verificado y no hay más elementos de acción asociados a ella",
+ "name": "Cumplido"
+ },
+ {
+ "description": "Recomendación entendida, pero no necesaria por los requisitos actuales",
+ "name": "No es necesario"
+ },
+ {
+ "description": "No aplicable para el diseño actual",
+ "name": "N/A"
+ }
+ ],
+ "waf": [
+ {
+ "name": "Fiabilidad"
+ },
+ {
+ "name": "Seguridad"
+ },
+ {
+ "name": "Costar"
+ },
+ {
+ "name": "Operaciones"
+ },
+ {
+ "name": "Rendimiento"
+ }
+ ],
+ "yesno": [
+ {
+ "name": "Sí"
+ },
+ {
+ "name": "No"
+ }
+ ]
+}
\ No newline at end of file
diff --git a/checklists/azure_storage_checklist.ja.json b/checklists/azure_storage_checklist.ja.json
new file mode 100644
index 000000000..ec33393dd
--- /dev/null
+++ b/checklists/azure_storage_checklist.ja.json
@@ -0,0 +1,566 @@
+{
+ "categories": [
+ {
+ "name": "ID およびアクセス管理"
+ },
+ {
+ "name": "ネットワーク トポロジと接続性"
+ },
+ {
+ "name": "BC と DR"
+ },
+ {
+ "name": "ガバナンスとセキュリティ"
+ },
+ {
+ "name": "コストガバナンス"
+ },
+ {
+ "name": "オペレーションマネジメント"
+ },
+ {
+ "name": "アプリケーションのデプロイメント"
+ },
+ {
+ "name": "安全"
+ }
+ ],
+ "items": [
+ {
+ "category": "安全",
+ "description": "ストレージに関連する Microsoft クラウド セキュリティ ベンチマークのガイダンスを適用する",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "id": "A01.01",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "概要",
+ "text": "「ストレージの Azure セキュリティ ベースライン」を検討する",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "Azure Storage は、既定ではパブリック IP アドレスを持ち、インターネットからアクセスできます。プライベート エンドポイントを使用すると、アクセスが必要な Azure コンピューティング リソースのみに Azure Storage を安全に公開できるため、パブリック インターネットへの露出がなくなります",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "id": "A02.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "ネットワーキング",
+ "text": "Azure Storage のプライベート エンドポイントの使用を検討する",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "新しく作成されたストレージ アカウントは ARM デプロイ モデルを使用して作成されるため、RBAC、監査などがすべて有効になります。サブスクリプションにクラシック デプロイ モデルの古いストレージ アカウントがないことを確認します",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "id": "A03.01",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "統治",
+ "text": "古いストレージ アカウントが \"クラシック デプロイ モデル\" を使用していないことを確認する",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "Microsoft Defender を活用して、不審なアクティビティや構成ミスについて学習します。",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "id": "A03.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "統治",
+ "text": "すべてのストレージ アカウントで Microsoft Defender を有効にする",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "論理的な削除メカニズムにより、誤って削除されたブロブを回復できます。",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "id": "A04.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "データの可用性",
+ "text": "BLOB の '論理的な削除' を有効にする",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "たとえば、機密性、プライバシー、コンプライアンス上の理由など、削除された情報をすぐに削除するようにアプリケーションで確認する必要がある場合など、特定の BLOB コンテナに対して「論理的な削除」を選択的に無効にすることを検討してください。",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "id": "A05.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "機密性",
+ "text": "BLOB の '論理的な削除' を無効にする",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "コンテナの論理的な削除を使用すると、コンテナが削除された後に、たとえば、誤って削除した操作から回復するなどして、コンテナを回復できます。",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "id": "A06.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "データの可用性",
+ "text": "コンテナの「論理的な削除」を有効にする",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "たとえば、機密性、プライバシー、コンプライアンス上の理由など、削除された情報をすぐに削除するようにアプリケーションで確認する必要がある場合など、特定の BLOB コンテナに対して「論理的な削除」を選択的に無効にすることを検討してください。",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "id": "A07.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "機密性",
+ "text": "コンテナの「論理的な削除」を無効にする",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "削除する前に、ユーザーに削除ロックを最初に解除するように強制することで、ストレージ アカウントが誤って削除されるのを防ぎます",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "id": "A08.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "データの可用性",
+ "text": "ストレージ アカウントでのリソース ロックの有効化",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "BLOB の \"訴訟ホールド\" または \"時間ベースの保持\" ポリシーを検討して、BLOB、コンテナー、またはストレージ アカウントを削除できないようにします。「不可能」は実際には「不可能」を意味することに注意してください。ストレージ アカウントに不変 BLOB が含まれている場合、そのストレージ アカウントを \"削除\" する唯一の方法は、Azure サブスクリプションをキャンセルすることです。",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "id": "A09.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "データの可用性、コンプライアンス",
+ "text": "不変ブロブについて考える",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "ストレージ アカウントへの保護されていない HTTP/80 アクセスを無効にして、すべてのデータ転送が暗号化され、整合性が保護され、サーバーが認証されるようにすることを検討してください。",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "id": "A10.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "ネットワーキング",
+ "text": "HTTPS を要求する (つまり、ストレージ アカウントのポート 80 を無効にする)",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "ストレージ アカウントでカスタム ドメイン (ホスト名) を構成する場合は、TLS/HTTPS が必要かどうかを確認します。その場合は、ストレージ アカウントの前に Azure CDN を配置する必要がある場合があります。",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "id": "A10.02",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "ネットワーキング",
+ "text": "HTTPS を適用する (HTTP を無効にする) 場合は、ストレージ アカウントにカスタム ドメイン (CNAME) を使用していないことを確認します。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "クライアントが SAS トークンを使用して BLOB データにアクセスするときに HTTPS を要求すると、資格情報の損失リスクを最小限に抑えるのに役立ちます。",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "id": "A10.03",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "ネットワーキング",
+ "text": "Shared Access Signature (SAS) トークンを HTTPS 接続のみに制限する",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": ".最新の TLS バージョンを適用すると、古いバージョンを使用しているクライアントからの要求が拒否されます。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "id": "A10.4",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "ネットワーキング",
+ "text": "ストレージ アカウントに最新の TLS バージョンを適用する",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "Microsoft Entra ID トークンは、可能な限り、共有アクセス署名よりも優先する必要があります",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "id": "A11.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "ID およびアクセス管理",
+ "text": "BLOB アクセスに Microsoft Entra ID トークンを使用する",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "ユーザー、グループ、またはアプリケーションにロールを割り当てる場合は、タスクの実行に必要なアクセス許可のみをそのセキュリティ プリンシパルに付与します。リソースへのアクセスを制限することで、意図しないデータの誤用と悪意のある誤用の両方を防ぐことができます。",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "id": "A11.02",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "ID およびアクセス管理",
+ "text": "IaM アクセス許可の最小特権",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "ユーザー委任 SAS は、Azure Active Directory (Azure AD) 資格情報と、SAS に指定されたアクセス許可によって保護されます。ユーザー委任 SAS は、そのスコープと機能の点でサービス SAS に似ていますが、サービス SAS よりもセキュリティ上の利点があります。",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "id": "A11.03",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "ID およびアクセス管理",
+ "text": "SAS を使用する場合は、ストレージ アカウント キー ベースの SAS よりも \"ユーザー委任 SAS\" を優先します。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "ストレージ アカウント キー (\"共有キー\") には、監査機能がほとんどありません。誰が/いつキーのコピーをフェッチしたかを監視することはできますが、キーが複数の人の手に渡ると、特定のユーザーに使用状況を帰属させることはできなくなります。Entra ID認証のみに依存すると、ストレージアクセスをユーザーに結び付けることが容易になります。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "id": "A11.04",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "ID およびアクセス管理",
+ "text": "Microsoft Entra ID アクセス (およびユーザー委任 SAS) のみがサポートされるように、ストレージ アカウント キーを無効にすることを検討してください。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "アクティビティ ログ データを使用して、ストレージ アカウントのセキュリティが (ストレージ アカウント キー、アクセス ポリシーなど) 表示または変更されているのは「いつ」、「誰が」、「何を」、「どのように」特定します。",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "id": "A12.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "モニタリング",
+ "text": "Azure Monitor を使用して、ストレージ アカウントでのコントロール プレーン操作を監査することを検討してください",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "キーの有効期限ポリシーを使用すると、アカウント アクセス キーのローテーションのリマインダーを設定できます。リマインダーは、指定した間隔が経過し、キーがまだローテーションされていない場合に表示されます。",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "id": "A13.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "ID およびアクセス管理",
+ "text": "ストレージ アカウント キーを使用する場合は、\"キーの有効期限ポリシー\" を有効にすることを検討してください",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "SAS 有効期限ポリシーは、SAS が有効である推奨間隔を指定します。SAS 有効期限ポリシーは、サービス SAS またはアカウント SAS に適用されます。ユーザーが、推奨間隔よりも長い有効期間でサービス SAS またはアカウント SAS を生成すると、警告が表示されます。",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "id": "A13.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "ID およびアクセス管理",
+ "text": "SAS 有効期限ポリシーの構成を検討する",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "保存されているアクセス ポリシーでは、ストレージ アカウント キーを再生成しなくても、サービス SAS のアクセス許可を取り消すことができます。",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "id": "A13.03",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "ID およびアクセス管理",
+ "text": "SASを保存されたアクセスポリシーにリンクすることを検討する",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "id": "A14.01",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "CI/CD",
+ "text": "チェックインされた接続文字列とストレージ アカウント キーを検出するように、アプリケーションのソース コード リポジトリを構成することを検討してください。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "理想的には、アプリケーションでマネージド ID を使用して Azure Storage に対する認証を行う必要があります。それが不可能な場合は、ストレージ資格情報 (接続文字列、ストレージ アカウント キー、SAS、サービス プリンシパル資格情報) を Azure KeyVault または同等のサービスに持つことを検討してください。",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "id": "A15.01",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "ID およびアクセス管理",
+ "text": "Azure KeyVault に接続文字列を格納することを検討してください (マネージド ID が不可能なシナリオの場合)",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "アドホック SAS サービス SAS またはアカウント SAS で短期的な有効期限を使用します。このように、SASが侵害された場合でも、SASは短時間しか有効ではありません。この方法は、保存されたアクセス ポリシーを参照できない場合に特に重要です。有効期限が近いと、BLOB にアップロードできる時間を制限することで、BLOB に書き込むことができるデータの量も制限されます。",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "id": "A15.02",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "ID およびアクセス管理",
+ "text": "アドホックSASの有効期間を短くするよう努める",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "SASを作成するときは、できるだけ具体的で制限的にしてください。1 つのリソースと操作には、より広範なアクセスを提供する SAS よりも SAS を優先します。",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "id": "A15.03",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "ID およびアクセス管理",
+ "text": "SAS に狭いスコープを適用する",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "SAS には、SAS を使用してリソースを要求する権限を与えられたクライアントの IP アドレスまたはアドレス範囲のパラメーターを含めることができます。",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "id": "A15.04",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "ID およびアクセス管理",
+ "text": "可能な限り、SAS のスコープを特定のクライアント IP アドレスに設定することを検討してください",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "SAS は、クライアントがアップロードするデータの量を制限することはできません。時間の経過に伴うストレージ量の価格設定モデルを考えると、クライアントが悪意を持って大きなコンテンツをアップロードしたかどうかを検証することは理にかなっているかもしれません。",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "id": "A15.05",
+ "service": "Azure Storage",
+ "severity": "低い",
+ "subcategory": "ID およびアクセス管理",
+ "text": "クライアントが SAS を使用してファイルをアップロードした後、アップロードされたデータを確認することを検討してください。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "「ローカル ユーザー アカウント」を使用して SFTP 経由で BLOB ストレージにアクセスする場合、「通常の」RBAC コントロールは適用されません。NFS または REST 経由の BLOB アクセスは、SFTP アクセスよりも制限が厳しい場合があります。残念ながら、2023 年初頭の時点で、SFTP エンドポイントで現在サポートされている ID 管理の形式は、ローカル ユーザーのみです",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "id": "A15.06",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "ID およびアクセス管理",
+ "text": "SFTP: SFTP アクセスの「ローカル ユーザー」の数を制限し、アクセスが必要かどうかを経時的に監査します。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "id": "A15.07",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "ID およびアクセス管理",
+ "text": "SFTP: SFTP エンドポイントは POSIX のような ACL をサポートしていません。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "ストレージは、CORS(Cross-Origin Resource Sharing)、つまり、異なるドメインのWebアプリが同一生成元ポリシーを緩和できるようにするHTTP機能をサポートしています。CORS を有効にするときは、CorsRules を最小限の特権に保ちます。",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "id": "A16.01",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "ネットワーキング",
+ "text": "過度に広範なCORSポリシーを避ける",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "保存データは常にサーバー側で暗号化され、さらにクライアント側でも暗号化される場合があります。サーバー側の暗号化は、プラットフォーム管理キー (デフォルト) またはカスタマー管理キーを使用して行われる場合があります。クライアント側の暗号化は、クライアントが BLOB ごとに暗号化/暗号化解除キーを Azure ストレージに提供するか、クライアント側で暗号化を完全に処理することによって行われます。したがって、機密性の保証については Azure Storage にまったく依存しません。",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "id": "A17.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "機密性と暗号化",
+ "text": "保存データの暗号化方法を決定します。データのスレッドモデルを理解する。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "id": "A17.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "機密性と暗号化",
+ "text": "プラットフォームの暗号化を使用するかどうかを決定します。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "id": "A17.03",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "機密性と暗号化",
+ "text": "クライアント側の暗号化を使用するかどうかを決定します。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "Resource Graph エクスプローラー (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) を利用して、匿名 BLOB アクセスを許可するストレージ アカウントを見つけます。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "id": "A18.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "ID およびアクセス管理",
+ "text": "パブリック BLOB の匿名アクセスが必要かどうか、または特定のストレージ アカウントに対して無効にできるかどうかを検討します。",
+ "waf": "安全"
+ },
+ {
+ "category": "オペレーションマネジメント",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "id": "B01.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "プラットフォームバージョン",
+ "text": "storagev2 アカウントタイプを活用して、パフォーマンスと信頼性を向上させます",
+ "waf": "確実"
+ },
+ {
+ "category": "BC と DR",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "id": "C01.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "subcategory": "可用性",
+ "text": "GRS、ZRS、またはGZRSストレージを活用して、最高の可用性を実現",
+ "waf": "確実"
+ },
+ {
+ "category": "BC と DR",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "id": "C01.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "フェイルオーバー",
+ "text": "フェールオーバー後の書き込み操作には、顧客管理のフェールオーバーを使用します",
+ "waf": "確実"
+ },
+ {
+ "category": "オペレーションマネジメント",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "id": "C01.03",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "フェイルオーバー",
+ "text": "Microsoft マネージド フェールオーバーの詳細を理解する",
+ "waf": "確実"
+ },
+ {
+ "category": "オペレーションマネジメント",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "id": "C01.04",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "subcategory": "データ保護",
+ "text": "ソフト削除を有効にする",
+ "waf": "確実"
+ }
+ ],
+ "metadata": {
+ "name": "Azure Storage Review Checklist",
+ "state": "Preview",
+ "timestamp": "August 12, 2024",
+ "waf": "all"
+ },
+ "severities": [
+ {
+ "name": "高い"
+ },
+ {
+ "name": "中程度"
+ },
+ {
+ "name": "低い"
+ }
+ ],
+ "status": [
+ {
+ "description": "このチェックはまだ見ていません",
+ "name": "未確認"
+ },
+ {
+ "description": "このチェックにはアクションアイテムが関連付けられています",
+ "name": "開ける"
+ },
+ {
+ "description": "このチェックは検証済みであり、これ以上のアクション アイテムは関連付けられていません",
+ "name": "達成"
+ },
+ {
+ "description": "推奨事項は理解されているが、現在の要件では必要ではない",
+ "name": "必須ではありません"
+ },
+ {
+ "description": "現在のデザインには適用されません",
+ "name": "該当なし"
+ }
+ ],
+ "waf": [
+ {
+ "name": "確実"
+ },
+ {
+ "name": "安全"
+ },
+ {
+ "name": "費用"
+ },
+ {
+ "name": "オペレーションズ"
+ },
+ {
+ "name": "パフォーマンス"
+ }
+ ],
+ "yesno": [
+ {
+ "name": "はい"
+ },
+ {
+ "name": "いいえ"
+ }
+ ]
+}
\ No newline at end of file
diff --git a/checklists/azure_storage_checklist.ko.json b/checklists/azure_storage_checklist.ko.json
new file mode 100644
index 000000000..dabfa75af
--- /dev/null
+++ b/checklists/azure_storage_checklist.ko.json
@@ -0,0 +1,566 @@
+{
+ "categories": [
+ {
+ "name": "ID 및 액세스 관리"
+ },
+ {
+ "name": "네트워크 토폴로지 및 연결성"
+ },
+ {
+ "name": "BC 및 DR"
+ },
+ {
+ "name": "거버넌스 및 보안"
+ },
+ {
+ "name": "비용 관리"
+ },
+ {
+ "name": "운영 관리"
+ },
+ {
+ "name": "응용 프로그램 배포"
+ },
+ {
+ "name": "안전"
+ }
+ ],
+ "items": [
+ {
+ "category": "안전",
+ "description": "스토리지와 관련된 Microsoft 클라우드 보안 벤치마크의 지침 적용",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "id": "A01.01",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": " 개요",
+ "text": "'스토리지에 대한 Azure 보안 기준'을 고려합니다.",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "Azure Storage는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트를 사용하면 액세스가 필요한 Azure Compute 리소스에만 Azure Storage를 안전하게 노출할 수 있으므로 공용 인터넷에 노출되지 않습니다",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "id": "A02.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "네트워킹",
+ "text": "Azure Storage에 프라이빗 엔드포인트를 사용하는 것이 좋습니다.",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "새로 만든 스토리지 계정은 ARM 배포 모델을 사용하여 생성되므로 RBAC, 감사 등이 모두 활성화됩니다. 구독에 클래식 배포 모델을 사용하는 이전 저장소 계정이 없는지 확인합니다.",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "id": "A03.01",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "지배구조",
+ "text": "이전 스토리지 계정이 '클래식 배포 모델'을 사용하지 않는지 확인",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "Microsoft Defender를 활용하여 의심스러운 활동 및 잘못된 구성에 대해 알아보세요.",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "id": "A03.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "지배구조",
+ "text": "모든 스토리지 계정에 대해 Microsoft Defender 사용",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "일시 삭제 메커니즘을 사용하면 실수로 삭제된 Blob을 복구할 수 있습니다.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "id": "A04.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "데이터 가용성",
+ "text": "Blob에 대해 '일시 삭제' 사용Enable 'soft delete' for blobs",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "id": "A05.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "기밀성",
+ "text": "Blob에 대해 '일시 삭제' 사용 안 함",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "컨테이너에 대한 일시 삭제를 사용하면 컨테이너가 삭제된 후 복구할 수 있습니다(예: 실수로 삭제한 작업에서 복구).",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "id": "A06.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "데이터 가용성",
+ "text": "컨테이너에 대해 '일시 삭제' 사용Enable 'soft delete' for containers",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "id": "A07.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "기밀성",
+ "text": "컨테이너에 대해 '일시 삭제' 사용 안 함",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "사용자가 삭제하기 전에 먼저 삭제 잠금을 제거하도록 강제하여 스토리지 계정의 우발적인 삭제를 방지합니다.",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "id": "A08.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "데이터 가용성",
+ "text": "스토리지 계정에 대한 리소스 잠금 사용Enable resource locks on storage accounts",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "Blob에 대한 '법적 보존' 또는 '시간 기반 보존' 정책을 고려하면 Blob, 컨테이너 또는 스토리지 계정을 삭제할 수 없습니다. '불가능한'은 실제로 '불가능한'을 의미합니다. 스토리지 계정에 변경할 수 없는 Blob이 포함되면 해당 스토리지 계정을 '제거'하는 유일한 방법은 Azure 구독을 취소하는 것입니다.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "id": "A09.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "데이터 가용성, 규정 준수",
+ "text": "변경할 수 없는 Blob 고려",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "스토리지 계정에 대한 보호되지 않는 HTTP/80 액세스를 사용하지 않도록 설정하여 모든 데이터 전송이 암호화되고 무결성이 보호되며 서버가 인증되도록 하는 것이 좋습니다. ",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "id": "A10.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "네트워킹",
+ "text": "HTTPS 필요, 즉 스토리지 계정에서 포트 80 사용 안 함Require HTTPS, i.e. disable port 80 on the storage account",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "스토리지 계정에서 사용자 지정 도메인(호스트 이름)을 구성할 때 TLS/HTTPS가 필요한지 확인합니다. 이 경우 스토리지 계정 앞에 Azure CDN을 배치해야 할 수 있습니다.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "id": "A10.02",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "네트워킹",
+ "text": "HTTPS를 적용(HTTP 사용 안 함)할 때 스토리지 계정에 사용자 지정 도메인(CNAME)을 사용하지 않는지 확인합니다.",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "클라이언트가 SAS 토큰을 사용하여 Blob 데이터에 액세스할 때 HTTPS를 요구하면 자격 증명 손실 위험을 최소화하는 데 도움이 됩니다.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "id": "A10.03",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "네트워킹",
+ "text": "SAS(공유 액세스 서명) 토큰을 HTTPS 연결로만 제한",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": ". 최신 TLS 버전을 적용하면 이전 버전을 사용하는 클라이언트의 요청이 거부됩니다. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "id": "A10.4",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "네트워킹",
+ "text": "스토리지 계정에 대한 최신 TLS 버전 적용Enforce the latest TLS version for a storage account",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "가능한 경우 Microsoft Entra ID 토큰을 공유 액세스 서명보다 선호해야 합니다",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "id": "A11.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "ID 및 액세스 관리",
+ "text": "Blob 액세스에 Microsoft Entra ID 토큰 사용Use Microsoft Entra ID tokens for blob access",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "사용자, 그룹 또는 응용 프로그램에 역할을 할당할 때 해당 보안 주체가 작업을 수행하는 데 필요한 권한만 부여합니다. 리소스에 대한 액세스를 제한하면 의도하지 않은 데이터 오용과 악의적인 데이터 오용을 모두 방지할 수 있습니다.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "id": "A11.02",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "ID 및 액세스 관리",
+ "text": "IaM 권한의 최소 권한",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "사용자 위임 SAS는 Azure AD(Azure Active Directory) 자격 증명과 SAS에 대해 지정된 권한으로 보호됩니다. 사용자 위임 SAS는 범위와 기능 측면에서 서비스 SAS와 유사하지만 서비스 SAS에 비해 보안상의 이점을 제공합니다. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "id": "A11.03",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "ID 및 액세스 관리",
+ "text": "SAS를 사용하는 경우 스토리지 계정 키 기반 SAS보다 '사용자 위임 SAS'를 선호합니다.",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "스토리지 계정 키('공유 키')에는 감사 기능이 거의 없습니다. 누가/언제 키 복사본을 가져왔는지 모니터링할 수 있지만 키가 여러 사람의 손에 들어가면 특정 사용자의 사용을 귀속시킬 수 없습니다. Entra ID 인증에만 의존하면 스토리지 액세스를 사용자에게 더 쉽게 연결할 수 있습니다. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "id": "A11.04",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "ID 및 액세스 관리",
+ "text": "Microsoft Entra ID 액세스(및 사용자 위임 SAS)만 지원되도록 스토리지 계정 키를 사용하지 않도록 설정하는 것이 좋습니다.",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "활동 로그 데이터를 사용하여 스토리지 계정의 보안을 '언제', '누가', '무엇을' 및 '어떻게' 확인하거나 변경합니다(예: 스토리지 계정 키, 액세스 정책 등).",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "id": "A12.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "모니터링",
+ "text": "Azure Monitor를 사용하여 스토리지 계정에 대한 컨트롤 플레인 작업을 감사하는 것이 좋습니다",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "키 만료 정책을 사용하면 계정 액세스 키의 교체에 대한 미리 알림을 설정할 수 있습니다. 지정된 간격이 경과하고 키가 아직 회전되지 않은 경우 알림이 표시됩니다.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "id": "A13.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "ID 및 액세스 관리",
+ "text": "스토리지 계정 키를 사용하는 경우 '키 만료 정책'을 사용하도록 설정하는 것이 좋습니다.",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "SAS 만료 정책은 SAS가 유효한 권장 간격을 지정합니다. SAS 만료 정책은 서비스 SAS 또는 계정 SAS에 적용됩니다. 사용자가 권장 간격보다 큰 유효성 간격으로 서비스 SAS 또는 계정 SAS를 생성하면 경고가 표시됩니다.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "id": "A13.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "ID 및 액세스 관리",
+ "text": "SAS 만료 정책을 구성하는 것이 좋습니다.",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "저장된 액세스 정책은 스토리지 계정 키를 다시 생성할 필요 없이 서비스 SAS에 대한 사용 권한을 취소할 수 있는 옵션을 제공합니다. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "id": "A13.03",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "ID 및 액세스 관리",
+ "text": "SAS를 저장된 액세스 정책에 연결하는 것이 좋습니다.",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "id": "A14.01",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "CI/CD (영문)",
+ "text": "체크 인된 연결 문자열 및 저장소 계정 키를 검색하도록 응용 프로그램의 소스 코드 리포지토리를 구성하는 것이 좋습니다.",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "이상적으로 애플리케이션은 관리 ID를 사용하여 Azure Storage에 인증해야 합니다. 가능하지 않은 경우 Azure KeyVault 또는 동등한 서비스에 스토리지 자격 증명(연결 문자열, 스토리지 계정 키, SAS, 서비스 주체 자격 증명)을 사용하는 것이 좋습니다.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "id": "A15.01",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "ID 및 액세스 관리",
+ "text": "Azure KeyVault에 연결 문자열을 저장하는 것이 좋습니다(관리 ID를 사용할 수 없는 시나리오에서).",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "임시 SAS 서비스 SAS 또는 계정 SAS에서 가까운 만료 시간을 사용합니다. 이러한 방식으로 SAS가 손상되더라도 짧은 시간 동안만 유효합니다. 이 방법은 저장된 액세스 정책을 참조할 수 없는 경우에 특히 중요합니다. 또한 단기 만료 시간은 Blob에 업로드할 수 있는 시간을 제한하여 Blob에 쓸 수 있는 데이터의 양을 제한합니다.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "id": "A15.02",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "ID 및 액세스 관리",
+ "text": "임시 SAS의 유효 기간을 단축하기 위해 노력",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "SAS를 만들 때는 가능한 한 구체적이고 제한적이어야 합니다. 훨씬 더 광범위한 액세스를 제공하는 SAS보다 단일 리소스 및 작업에 대해 SAS를 선호합니다.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "id": "A15.03",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "ID 및 액세스 관리",
+ "text": "SAS에 좁은 범위 적용",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "SAS에는 SAS를 사용하여 리소스를 요청할 수 있는 권한이 있는 클라이언트 IP 주소 또는 주소 범위에 대한 매개 변수가 포함될 수 있습니다. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "id": "A15.04",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "ID 및 액세스 관리",
+ "text": "가능한 경우 SAS 범위를 특정 클라이언트 IP 주소로 지정하는 것이 좋습니다",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "SAS는 클라이언트가 업로드하는 데이터의 양을 제한할 수 없습니다. 시간 경과에 따른 스토리지 양의 가격 책정 모델을 감안할 때 클라이언트가 악의적으로 큰 콘텐츠를 업로드했는지 여부를 확인하는 것이 합리적일 수 있습니다.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "id": "A15.05",
+ "service": "Azure Storage",
+ "severity": "낮다",
+ "subcategory": "ID 및 액세스 관리",
+ "text": "클라이언트가 SAS를 사용하여 파일을 업로드한 후 업로드된 데이터를 확인하는 것이 좋습니다. ",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "'로컬 사용자 계정'을 사용하여 SFTP를 통해 Blob Storage에 액세스하는 경우 '일반적인' RBAC 컨트롤이 적용되지 않습니다. NFS 또는 REST를 통한 Blob 액세스는 SFTP 액세스보다 더 제한적일 수 있습니다. 안타깝게도 2023년 초부터 로컬 사용자는 현재 SFTP 엔드포인트에 대해 지원되는 유일한 ID 관리 형태입니다",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "id": "A15.06",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "ID 및 액세스 관리",
+ "text": "SFTP: SFTP 액세스를 위한 '로컬 사용자'의 수를 제한하고 시간이 지남에 따라 액세스가 필요한지 여부를 감사합니다.",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "id": "A15.07",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "ID 및 액세스 관리",
+ "text": "SFTP: SFTP 엔드포인트는 POSIX와 유사한 ACL을 지원하지 않습니다.",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "스토리지는 CORS(Cross-Origin Resource Sharing), 즉 다른 도메인의 웹 앱이 동일 출처 정책을 완화할 수 있도록 하는 HTTP 기능을 지원합니다. CORS를 사용하도록 설정하는 경우 CorsRules를 최소 권한으로 유지합니다.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "id": "A16.01",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "네트워킹",
+ "text": "지나치게 광범위한 CORS 정책 방지",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "미사용 데이터는 항상 서버 쪽에서 암호화되며 클라이언트 쪽에서도 암호화될 수 있습니다. 서버 쪽 암호화는 플랫폼 관리형 키(기본값) 또는 고객 관리형 키를 사용하여 발생할 수 있습니다. 클라이언트 쪽 암호화는 클라이언트가 Azure Storage에 Blob별로 암호화/암호 해독 키를 제공하도록 하거나 클라이언트 쪽에서 암호화를 완전히 처리하여 발생할 수 있습니다. 따라서 기밀 보장을 위해 Azure Storage에 전혀 의존하지 않습니다.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "id": "A17.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "기밀성 및 암호화",
+ "text": "미사용 데이터를 암호화하는 방법을 결정합니다. 데이터에 대한 스레드 모델을 이해합니다.",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "id": "A17.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "기밀성 및 암호화",
+ "text": "어떤 플랫폼 암호화를 사용해야 하는지 확인합니다.",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "id": "A17.03",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "기밀성 및 암호화",
+ "text": "클라이언트 쪽 암호화를 사용해야 하는지 여부를 결정합니다.",
+ "waf": "안전"
+ },
+ {
+ "category": "안전",
+ "description": "리소스 그래프 탐색기(리소스 | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true)를 활용하여 익명 Blob 액세스를 허용하는 스토리지 계정을 찾습니다.",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "id": "A18.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "ID 및 액세스 관리",
+ "text": "공용 Blob 익명 액세스가 필요한지 또는 특정 스토리지 계정에 대해 사용하지 않도록 설정할 수 있는지 여부를 고려합니다. ",
+ "waf": "안전"
+ },
+ {
+ "category": "운영 관리",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "id": "B01.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "플랫폼 버전",
+ "text": "성능 및 안정성 향상을 위해 storagev2 계정 유형 활용",
+ "waf": "신뢰도"
+ },
+ {
+ "category": "BC 및 DR",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "id": "C01.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "subcategory": "가용성",
+ "text": "최고의 가용성을 위해 GRS, ZRS 또는 GZRS 스토리지 활용",
+ "waf": "신뢰도"
+ },
+ {
+ "category": "BC 및 DR",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "id": "C01.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "페일오버",
+ "text": "장애 조치(failover) 후 쓰기 작업의 경우 고객 관리 장애 조치(failover)를 사용합니다. ",
+ "waf": "신뢰도"
+ },
+ {
+ "category": "운영 관리",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "id": "C01.03",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "페일오버",
+ "text": "Microsoft 관리 장애 조치(failover) 세부 정보 이해",
+ "waf": "신뢰도"
+ },
+ {
+ "category": "운영 관리",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "id": "C01.04",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "subcategory": "데이터 보호",
+ "text": "일시 삭제 사용",
+ "waf": "신뢰도"
+ }
+ ],
+ "metadata": {
+ "name": "Azure Storage Review Checklist",
+ "state": "Preview",
+ "timestamp": "August 12, 2024",
+ "waf": "all"
+ },
+ "severities": [
+ {
+ "name": "높다"
+ },
+ {
+ "name": "보통"
+ },
+ {
+ "name": "낮다"
+ }
+ ],
+ "status": [
+ {
+ "description": "이 검사는 아직 검토되지 않았습니다",
+ "name": "확인되지 않음"
+ },
+ {
+ "description": "이 검사와 연관된 작업 항목이 있습니다",
+ "name": "열다"
+ },
+ {
+ "description": "이 검사는 확인되었으며 이와 관련된 추가 작업 항목이 없습니다",
+ "name": "성취"
+ },
+ {
+ "description": "권장 사항을 이해하지만 현재 요구 사항에 필요하지 않음",
+ "name": "필요 없음"
+ },
+ {
+ "description": "현재 설계에는 적용되지 않습니다.",
+ "name": "해당 없음"
+ }
+ ],
+ "waf": [
+ {
+ "name": "신뢰도"
+ },
+ {
+ "name": "안전"
+ },
+ {
+ "name": "비용"
+ },
+ {
+ "name": "작업"
+ },
+ {
+ "name": "공연"
+ }
+ ],
+ "yesno": [
+ {
+ "name": "예"
+ },
+ {
+ "name": "아니요"
+ }
+ ]
+}
\ No newline at end of file
diff --git a/checklists/azure_storage_checklist.pt.json b/checklists/azure_storage_checklist.pt.json
new file mode 100644
index 000000000..0f2972ca6
--- /dev/null
+++ b/checklists/azure_storage_checklist.pt.json
@@ -0,0 +1,566 @@
+{
+ "categories": [
+ {
+ "name": "Gerenciamento de identidade e acesso"
+ },
+ {
+ "name": "Topologia e conectividade de rede"
+ },
+ {
+ "name": "BC e DR"
+ },
+ {
+ "name": "Governança e segurança"
+ },
+ {
+ "name": "Governança de custos"
+ },
+ {
+ "name": "Gestão de Operações"
+ },
+ {
+ "name": "Implantação de aplicativos"
+ },
+ {
+ "name": "Segurança"
+ }
+ ],
+ "items": [
+ {
+ "category": "Segurança",
+ "description": "Aplicar as diretrizes do parâmetro de comparação de segurança de nuvem da Microsoft relacionado ao armazenamento",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "id": "A01.01",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": " Visão geral",
+ "text": "Considere a 'linha de base de segurança do Azure para armazenamento'",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Por padrão, o Armazenamento do Azure tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem expor com segurança o Armazenamento do Azure apenas aos recursos de Computação do Azure que precisam de acesso, eliminando assim a exposição à Internet pública",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "id": "A02.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Rede",
+ "text": "Considere usar pontos de extremidade privados para o Armazenamento do Azure",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "As contas de armazenamento recém-criadas são criadas usando o modelo de implantação do ARM, para que o RBAC, a auditoria etc. estejam habilitados. Verifique se não há contas de armazenamento antigas com o modelo de implantação clássico em uma assinatura",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "id": "A03.01",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Governança",
+ "text": "Verifique se as contas de armazenamento mais antigas não estão usando o \"modelo de implantação clássico\"",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Aproveite o Microsoft Defender para saber mais sobre atividades suspeitas e configurações incorretas.",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "id": "A03.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Governança",
+ "text": "Habilitar o Microsoft Defender para todas as suas contas de armazenamento",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "O mecanismo de exclusão reversível permite recuperar blobs excluídos acidentalmente.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "id": "A04.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Disponibilidade de dados",
+ "text": "Habilitar 'exclusão reversível' para blobs",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Considere desabilitar seletivamente a \"exclusão reversível\" para determinados contêineres de blob, por exemplo, se o aplicativo precisar garantir que as informações excluídas sejam excluídas imediatamente, por exemplo, por motivos de confidencialidade, privacidade ou conformidade. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "id": "A05.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Confidencialidade",
+ "text": "Desabilitar a 'exclusão reversível' para blobs",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "A exclusão reversível para contêineres permite que você recupere um contêiner depois que ele foi excluído, por exemplo, recuperar de uma operação de exclusão acidental.",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "id": "A06.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Disponibilidade de dados",
+ "text": "Habilitar 'exclusão reversível' para contêineres",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Considere desabilitar seletivamente a \"exclusão reversível\" para determinados contêineres de blob, por exemplo, se o aplicativo precisar garantir que as informações excluídas sejam excluídas imediatamente, por exemplo, por motivos de confidencialidade, privacidade ou conformidade. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "id": "A07.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Confidencialidade",
+ "text": "Desabilitar a 'exclusão reversível' para contêineres",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Impede a exclusão acidental de uma conta de armazenamento, forçando o usuário a remover primeiro o bloqueio de exclusão, antes da exclusão",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "id": "A08.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Disponibilidade de dados",
+ "text": "Habilitar bloqueios de recursos em contas de armazenamento",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Considere as políticas de 'retenção legal' ou 'retenção baseada em tempo' para blobs, de modo que seja impossível excluir o blob, o contêiner ou a conta de armazenamento. Observe que 'impossível' na verdade significa 'impossível'; depois que uma conta de armazenamento contém um blob imutável, a única maneira de \"se livrar\" dessa conta de armazenamento é cancelando a assinatura do Azure.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "id": "A09.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Disponibilidade de dados, conformidade",
+ "text": "Considere blobs imutáveis",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Considere desabilitar o acesso HTTP/80 desprotegido à conta de armazenamento, para que todas as transferências de dados sejam criptografadas, protegidas por integridade e o servidor seja autenticado. ",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "id": "A10.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Rede",
+ "text": "Exigir HTTPS, ou seja, desabilitar a porta 80 na conta de armazenamento",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Ao configurar um domínio personalizado (nome do host) em uma conta de armazenamento, verifique se você precisa de TLS/HTTPS; nesse caso, talvez seja necessário colocar a CDN do Azure na frente de sua conta de armazenamento.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "id": "A10.02",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Rede",
+ "text": "Ao impor HTTPS (desabilitando o HTTP), verifique se você não usa domínios personalizados (CNAME) para a conta de armazenamento.",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Exigir HTTPS quando um cliente usa um token SAS para acessar dados de blob ajuda a minimizar o risco de perda de credenciais.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "id": "A10.03",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Rede",
+ "text": "Limitar tokens de assinatura de acesso compartilhado (SAS) apenas a conexões HTTPS",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": ". A imposição da versão mais recente do TLS rejeitará a solicitação de clientes que usam a versão mais antiga. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "id": "A10.4",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Rede",
+ "text": "Impor a versão mais recente do TLS para uma conta de armazenamento",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Os tokens de ID do Microsoft Entra devem ser favorecidos em relação às assinaturas de acesso compartilhado, sempre que possível",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "id": "A11.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gerenciamento de identidade e acesso",
+ "text": "Usar tokens de ID do Microsoft Entra para acesso a blobs",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Ao atribuir uma função a um usuário, grupo ou aplicativo, conceda a essa entidade de segurança apenas as permissões necessárias para que ela execute suas tarefas. Limitar o acesso aos recursos ajuda a evitar o uso indevido não intencional e mal-intencionado de seus dados.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "id": "A11.02",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Gerenciamento de identidade e acesso",
+ "text": "Privilégios mínimos em permissões de IaM",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Uma SAS de delegação de usuário é protegida com credenciais do Azure Active Directory (Azure AD) e também pelas permissões especificadas para a SAS. Uma SAS de delegação de usuário é análoga a uma SAS de serviço em termos de escopo e função, mas oferece benefícios de segurança em relação à SAS de serviço. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "id": "A11.03",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gerenciamento de identidade e acesso",
+ "text": "Ao usar SAS, prefira 'SAS de delegação de usuário' em vez de SAS baseada em chave de conta de armazenamento.",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "As chaves da conta de armazenamento (\"chaves compartilhadas\") têm muito poucos recursos de auditoria. Embora possa ser monitorado em quem/quando buscou uma cópia das chaves, uma vez que as chaves estão nas mãos de várias pessoas, é impossível atribuir o uso a um usuário específico. Confiar apenas na autenticação do Entra ID facilita o acesso ao armazenamento a um usuário. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "id": "A11.04",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gerenciamento de identidade e acesso",
+ "text": "Considere desabilitar as chaves da conta de armazenamento, para que haja suporte apenas para o acesso à ID do Microsoft Entra (e à SAS de delegação de usuário).",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Use os dados do Log de Atividades para identificar \"quando\", \"quem\", \"o quê\" e \"como\" a segurança da sua conta de armazenamento está sendo exibida ou alterada (ou seja, chaves da conta de armazenamento, políticas de acesso etc.).",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "id": "A12.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Monitorização",
+ "text": "Considere usar o Azure Monitor para auditar as operações do painel de controle na conta de armazenamento",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Uma política de expiração de chave permite que você defina um lembrete para a rotação das chaves de acesso da conta. O lembrete é exibido se o intervalo especificado tiver decorrido e as teclas ainda não tiverem sido giradas.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "id": "A13.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Gerenciamento de identidade e acesso",
+ "text": "Ao usar chaves de conta de armazenamento, considere habilitar uma 'política de expiração de chave'",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Uma política de expiração de SAS especifica um intervalo recomendado durante o qual a SAS é válida. As políticas de expiração de SAS se aplicam a uma SAS de serviço ou a uma SAS de conta. Quando um usuário gera SAS de serviço ou uma SAS de conta com um intervalo de validade maior que o intervalo recomendado, ele verá um aviso.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "id": "A13.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Gerenciamento de identidade e acesso",
+ "text": "Considere configurar uma política de expiração de SAS",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "As políticas de acesso armazenadas oferecem a opção de revogar permissões para uma SAS de serviço sem precisar regenerar as chaves da conta de armazenamento. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "id": "A13.03",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Gerenciamento de identidade e acesso",
+ "text": "Considere vincular SAS a uma política de acesso armazenada",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "id": "A14.01",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "CI/CD",
+ "text": "Considere configurar o repositório de código-fonte do aplicativo para detectar cadeias de conexão e chaves de conta de armazenamento com check-in.",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Idealmente, seu aplicativo deve usar uma identidade gerenciada para autenticar no Armazenamento do Azure. Se isso não for possível, considere ter a credencial de armazenamento (cadeia de conexão, chave da conta de armazenamento, SAS, credencial da entidade de serviço) no Azure KeyVault ou em um serviço equivalente.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "id": "A15.01",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gerenciamento de identidade e acesso",
+ "text": "Considere armazenar cadeias de conexão no Azure KeyVault (em cenários em que as identidades gerenciadas não são possíveis)",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Use tempos de expiração de curto prazo em uma SAS de serviço SAS ad hoc ou SAS de conta. Dessa forma, mesmo que uma SAS seja comprometida, ela é válida apenas por um curto período de tempo. Essa prática é especialmente importante se você não puder fazer referência a uma política de acesso armazenada. Os tempos de expiração de curto prazo também limitam a quantidade de dados que podem ser gravados em um blob, limitando o tempo disponível para carregar nele.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "id": "A15.02",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gerenciamento de identidade e acesso",
+ "text": "Esforce-se por períodos de validade curtos para SAS ad-hoc",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Ao criar uma SAS, seja o mais específico e restritivo possível. Prefira uma SAS para um único recurso e operação em vez de uma SAS que oferece acesso muito mais amplo.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "id": "A15.03",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Gerenciamento de identidade e acesso",
+ "text": "Aplicar um escopo restrito a uma SAS",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Uma SAS pode incluir parâmetros nos quais os endereços IP do cliente ou intervalos de endereços estão autorizados a solicitar um recurso usando a SAS. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "id": "A15.04",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Gerenciamento de identidade e acesso",
+ "text": "Considere definir o escopo da SAS para um endereço IP de cliente específico, sempre que possível",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Uma SAS não pode restringir a quantidade de dados que um cliente carrega; Dado o modelo de preços da quantidade de armazenamento ao longo do tempo, pode fazer sentido validar se os clientes carregaram conteúdos maliciosamente grandes.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "id": "A15.05",
+ "service": "Azure Storage",
+ "severity": "Baixo",
+ "subcategory": "Gerenciamento de identidade e acesso",
+ "text": "Considere verificar os dados carregados depois que os clientes usaram uma SAS para carregar um arquivo. ",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Ao acessar o armazenamento de blobs por meio do SFTP usando uma \"conta de usuário local\", os controles RBAC \"usuais\" não se aplicam. O acesso a blobs via NFS ou REST pode ser mais restritivo do que o acesso SFTP. Infelizmente, a partir do início de 2023, os usuários locais são a única forma de gerenciamento de identidade com suporte atual para o endpoint SFTP",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "id": "A15.06",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gerenciamento de identidade e acesso",
+ "text": "SFTP: limite a quantidade de \"usuários locais\" para acesso SFTP e audite se o acesso é necessário ao longo do tempo.",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "id": "A15.07",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Gerenciamento de identidade e acesso",
+ "text": "SFTP: o endpoint SFTP não oferece suporte a ACLs semelhantes a POSIX.",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "O armazenamento oferece suporte ao CORS (Cross-Origin Resource Sharing), ou seja, um recurso HTTP que permite que aplicativos Web de um domínio diferente afrouxem a política de mesma origem. Ao habilitar o CORS, mantenha as CorsRules com o menor privilégio.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "id": "A16.01",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Rede",
+ "text": "Evite políticas de CORS excessivamente amplas",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Os dados em repouso são sempre criptografados no lado do servidor e, além disso, também podem ser criptografados no lado do cliente. A criptografia do lado do servidor pode ocorrer usando uma chave gerenciada pela plataforma (padrão) ou uma chave gerenciada pelo cliente. A criptografia do lado do cliente pode acontecer fazendo com que o cliente forneça uma chave de criptografia/descriptografia por blob para o armazenamento do Azure ou manipulando completamente a criptografia no lado do cliente. portanto, não dependendo do Armazenamento do Azure para garantias de confidencialidade.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "id": "A17.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Confidencialidade e Criptografia",
+ "text": "Determine como os dados em repouso devem ser criptografados. Entenda o modelo de thread para dados.",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "id": "A17.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Confidencialidade e Criptografia",
+ "text": "Determine qual/se a criptografia de plataforma deve ser usada.",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "id": "A17.03",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Confidencialidade e Criptografia",
+ "text": "Determine qual/se a criptografia do lado do cliente deve ser usada.",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Segurança",
+ "description": "Aproveite o Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) para localizar contas de armazenamento que permitem acesso anônimo a blobs.",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "id": "A18.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Gerenciamento de identidade e acesso",
+ "text": "Considere se o acesso anônimo de blob público é necessário ou se ele pode ser desabilitado para determinadas contas de armazenamento. ",
+ "waf": "Segurança"
+ },
+ {
+ "category": "Gestão de Operações",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "id": "B01.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Versão da plataforma",
+ "text": "Aproveite um tipo de conta storagev2 para melhor desempenho e confiabilidade",
+ "waf": "Fiabilidade"
+ },
+ {
+ "category": "BC e DR",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "id": "C01.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "subcategory": "Disponibilidade",
+ "text": "Aproveite o armazenamento GRS, ZRS ou GZRS para obter a mais alta disponibilidade",
+ "waf": "Fiabilidade"
+ },
+ {
+ "category": "BC e DR",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "id": "C01.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Failover",
+ "text": "Para operação de gravação após o failover, use o failover gerenciado pelo cliente ",
+ "waf": "Fiabilidade"
+ },
+ {
+ "category": "Gestão de Operações",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "id": "C01.03",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Failover",
+ "text": "Entender os detalhes do failover gerenciado pela Microsoft",
+ "waf": "Fiabilidade"
+ },
+ {
+ "category": "Gestão de Operações",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "id": "C01.04",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "subcategory": "Proteção de dados",
+ "text": "Habilitar exclusão reversível",
+ "waf": "Fiabilidade"
+ }
+ ],
+ "metadata": {
+ "name": "Azure Storage Review Checklist",
+ "state": "Preview",
+ "timestamp": "August 12, 2024",
+ "waf": "all"
+ },
+ "severities": [
+ {
+ "name": "Alto"
+ },
+ {
+ "name": "Média"
+ },
+ {
+ "name": "Baixo"
+ }
+ ],
+ "status": [
+ {
+ "description": "Esta verificação ainda não foi analisada",
+ "name": "Não verificado"
+ },
+ {
+ "description": "Há um item de ação associado a essa verificação",
+ "name": "Abrir"
+ },
+ {
+ "description": "Essa verificação foi verificada e não há mais itens de ação associados a ela",
+ "name": "Cumprido"
+ },
+ {
+ "description": "Recomendação compreendida, mas não necessária pelos requisitos atuais",
+ "name": "Não é necessário"
+ },
+ {
+ "description": "Não aplicável para o projeto atual",
+ "name": "N/A"
+ }
+ ],
+ "waf": [
+ {
+ "name": "Fiabilidade"
+ },
+ {
+ "name": "Segurança"
+ },
+ {
+ "name": "Custar"
+ },
+ {
+ "name": "Operações"
+ },
+ {
+ "name": "Desempenho"
+ }
+ ],
+ "yesno": [
+ {
+ "name": "Sim"
+ },
+ {
+ "name": "Não"
+ }
+ ]
+}
\ No newline at end of file
diff --git a/checklists/azure_storage_checklist.zh-Hant.json b/checklists/azure_storage_checklist.zh-Hant.json
new file mode 100644
index 000000000..dbf496cf5
--- /dev/null
+++ b/checklists/azure_storage_checklist.zh-Hant.json
@@ -0,0 +1,566 @@
+{
+ "categories": [
+ {
+ "name": "身份和訪問管理"
+ },
+ {
+ "name": "網路拓撲和連接"
+ },
+ {
+ "name": "BC 和DR"
+ },
+ {
+ "name": "治理與安全"
+ },
+ {
+ "name": "成本治理"
+ },
+ {
+ "name": "運營管理"
+ },
+ {
+ "name": "應用程式部署"
+ },
+ {
+ "name": "安全"
+ }
+ ],
+ "items": [
+ {
+ "category": "安全",
+ "description": "應用與存儲相關的 Microsoft 雲安全基準中的指導",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "id": "A01.01",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "概述",
+ "text": "請考慮「存儲的 Azure 安全基線”",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "默認情況下，Azure 儲存具有公共IP位址，並且可通過Internet訪問。專用終結點允許僅向需要訪問的 Azure 計算資源安全地公開 Azure 存儲，從而消除對公共 Internet 的暴露",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "id": "A02.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "聯網",
+ "text": "考慮將專用終結點用於 Azure 存儲",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "新創建的存儲帳戶是使用ARM部署模型創建的，因此 RBAC、審核等都已啟用。確保訂閱中沒有具有經典部署模型的舊存儲帳戶",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "id": "A03.01",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "統轄",
+ "text": "確保較舊的存儲帳戶未使用“經典部署模型”",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "利用 Microsoft Defender 瞭解可疑活動和錯誤配置。",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "id": "A03.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "統轄",
+ "text": "為所有存儲帳戶啟用 Microsoft Defender",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "軟刪除機制允許恢復意外刪除的 blob。",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "id": "A04.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "數據可用性",
+ "text": "為 blob 啟用“軟刪除”",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "考慮有選擇地禁用某些 blob 容器的「軟刪除」 例如，如果應用程式必須確保立即刪除已刪除的資訊，例如出於機密性、隱私或合規性原因。",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "id": "A05.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "保密性",
+ "text": "禁用 blob 的“軟刪除”",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "容器的軟刪除使您能夠在刪除容器后恢復容器，例如從意外刪除操作中恢復。",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "id": "A06.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "數據可用性",
+ "text": "為容器啟用“軟刪除”",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "考慮有選擇地禁用某些 blob 容器的「軟刪除」 例如，如果應用程式必須確保立即刪除已刪除的資訊，例如出於機密性、隱私或合規性原因。",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "id": "A07.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "保密性",
+ "text": "禁用容器的“軟刪除”",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "通過強制使用者先刪除刪除鎖，然後再刪除存儲帳戶，防止意外刪除存儲帳戶",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "id": "A08.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "數據可用性",
+ "text": "在存儲帳戶上啟用資源鎖定",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "請考慮對 blob 使用“合法保留”或“基于時間的保留”策略，以便無法刪除 blob、容器或存儲帳戶。請注意，「不可能」實際上意味著「不可能」;一旦存儲帳戶包含不可變的 blob，「擺脫」該存儲帳戶的唯一方法是取消 Azure 訂閱。",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "id": "A09.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "數據可用性、合規性",
+ "text": "考慮不可變的 blob",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "請考慮禁用對存儲帳戶的未受保護的 HTTP/80 訪問，以便對所有數據傳輸進行加密、完整性保護，並且對伺服器進行身份驗證。",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "id": "A10.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "聯網",
+ "text": "需要 HTTPS，即在儲存帳戶上禁用埠 80",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "在儲存帳戶上配置自定義域（主機名）時，請檢查是否需要 TLS/HTTPS;如果是這樣，可能需要將 Azure CDN 放在存儲帳戶的前面。",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "id": "A10.02",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "聯網",
+ "text": "強制執行 HTTPS（禁用 HTTP）時，請檢查是否不要對儲存帳戶使用自定義域 （CNAME）。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "當用戶端使用SAS令牌訪問 blob 資料時，要求使用 HTTPS 有助於最大程度地降低憑據丟失的風險。",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "id": "A10.03",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "聯網",
+ "text": "將共享訪問簽名 （SAS） 令牌限製為僅 HTTPS 連接",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": ".強制執行最新的 TLS 版本將拒絕來自使用舊版本的用戶端的請求。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "id": "A10.4",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "聯網",
+ "text": "強制實施存儲帳戶的最新 TLS 版本",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "在可能的情況下，應優先使用 Microsoft Entra ID 令牌，而不是共用訪問簽名",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "id": "A11.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "身份和訪問管理",
+ "text": "使用 Microsoft Entra ID 令牌進行 blob 訪問",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "為使用者、組或應用程式分配角色時，請僅授予該安全主體執行任務所需的許可權。限制對資源的訪問有助於防止無意和惡意濫用數據。",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "id": "A11.02",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "身份和訪問管理",
+ "text": "IaM 許可權中的最小特權",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "使用者委派 SAS 使用 Azure Active Directory （Azure AD） 憑據以及為 SAS 指定的許可權進行保護。使用者委派 SAS 在範圍和功能方面類似於服務 SAS，但與服務 SAS 相比，它提供了安全優勢。",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "id": "A11.03",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "身份和訪問管理",
+ "text": "使用 SAS 時，首選「使用者委派 SAS」，而不是基於存儲帳戶密鑰的 SAS。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "存儲帳戶金鑰（“共用金鑰”）幾乎沒有審核功能。雖然可以監控誰/何時獲取了密鑰的副本，但一旦密鑰掌握在多人手中，就不可能將使用方式歸因於特定使用者。僅依賴 Entra ID 身份驗證可以更輕鬆地將存儲訪問許可權與用戶綁定。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "id": "A11.04",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "身份和訪問管理",
+ "text": "請考慮禁用存儲帳戶密鑰，以便僅支援 Microsoft Entra ID 訪問（和使用者委派 SAS）。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "使用活動日誌數據來確定查看或更改存儲帳戶安全性的“時間”、“人員”、“內容”和“方式”（即存儲帳戶密鑰、訪問策略等）。",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "id": "A12.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "監測",
+ "text": "請考慮使用 Azure Monitor 審核存儲帳戶上的控制平面操作",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "通過金鑰過期策略，您可以設置帳戶訪問金鑰輪換的提醒。如果已過指定的時間間隔且尚未旋轉鍵，則會顯示提醒。",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "id": "A13.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "身份和訪問管理",
+ "text": "使用存儲帳戶密鑰時，請考慮啟用“金鑰過期策略”",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "SAS 過期策略指定了 SAS 的有效時間間隔。SAS 過期策略適用於服務 SAS 或帳戶 SAS。當使用者生成的服務 SAS 或帳戶 SAS 的有效期間隔大於建議的時間間隔時，他們將看到警告。",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "id": "A13.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "身份和訪問管理",
+ "text": "考慮配置 SAS 過期策略",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "通過存儲訪問策略，可以選擇撤銷服務 SAS 的許可權，而無需重新生成存儲帳戶密鑰。",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "id": "A13.03",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "身份和訪問管理",
+ "text": "考慮將 SAS 連結到儲存存取策略",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "id": "A14.01",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "CI/CD",
+ "text": "請考慮配置應用程式的原始程式碼儲存庫，以檢測簽入的連接字串和存儲帳戶密鑰。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "理想情況下，應用程式應使用託管標識向 Azure 儲存進行身份驗證。如果無法做到這一點，請考慮在 Azure KeyVault 或等效服務中擁有存儲憑據（連接字串、存儲帳戶密鑰、SAS、服務主體憑據）。",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "id": "A15.01",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "身份和訪問管理",
+ "text": "請考慮在 Azure KeyVault 中儲存連接字串（在無法使用託管標識的情況下）",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "在臨時 SAS 服務 SAS 或帳戶 SAS 上使用近期過期時間。這樣，即使 SAS 遭到入侵，它也只會在短時間內有效。如果無法引用存儲訪問策略，則這種做法尤為重要。近期過期時間還通過限制可用於上傳到 blob 的時間來限制可以寫入 blob 的數據量。",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "id": "A15.02",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "身份和訪問管理",
+ "text": "爭取縮短臨時 SAS 的有效期",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "創建 SAS 時，請盡可能具體且具有限制性。首選單一資源和操作的 SAS，而不是提供更廣泛訪問許可權的 SAS。",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "id": "A15.03",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "身份和訪問管理",
+ "text": "對SAS應用窄範圍",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "SAS 可以包含用戶端 IP 位址或位址範圍有權使用 SAS 請求資源的參數。",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "id": "A15.04",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "身份和訪問管理",
+ "text": "盡可能考慮將SAS的範圍限定為特定的用戶端IP位址",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "SAS無法限制用戶端上傳的數據量;考慮到存儲量隨時間變化的定價模型，驗證用戶端是否惡意上傳了大量內容可能很有意義。",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "id": "A15.05",
+ "service": "Azure Storage",
+ "severity": "低",
+ "subcategory": "身份和訪問管理",
+ "text": "在用戶端使用SAS上傳檔后，請考慮檢查上傳的數據。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "使用「本地使用者帳戶」通過 SFTP 訪問 blob 儲存時，“通常”的 RBAC 控制不適用。通過 NFS 或 REST 進行的 Blob 訪問可能比 SFTP 訪問更具限制性。遺憾的是，截至 2023 年初，本地使用者是 SFTP 端點目前支援的唯一身份管理形式",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "id": "A15.06",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "身份和訪問管理",
+ "text": "SFTP：限制 SFTP 訪問的「本地使用者」數量，並審核隨著時間的推移是否需要訪問。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "id": "A15.07",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "身份和訪問管理",
+ "text": "SFTP：SFTP 端點不支持類似 POSIX 的 ACL。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "存儲支援 CORS（跨源資源分享），即一種 HTTP 功能，使來自不同域的 Web 應用程式能夠放鬆同源策略。啟用 CORS 時，請將 CorsRules 保留為最低許可權。",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "id": "A16.01",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "聯網",
+ "text": "避免過於寬泛的 CORS 策略",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "靜態數據始終在伺服器端加密，此外也可能在用戶端加密。伺服器端加密可能使用平臺管理的金鑰（預設）或客戶管理的金鑰進行。用戶端加密可以通過讓用戶端按 blob 向 Azure 儲存提供加密/解密金鑰，或者完全在用戶端處理加密來實現。因此，完全不依賴 Azure 存儲來保證機密性。",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "id": "A17.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "保密性和加密",
+ "text": "確定應如何加密靜態數據。了解數據的線程模型。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "id": "A17.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "保密性和加密",
+ "text": "確定應使用哪種/是否應使用平臺加密。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "id": "A17.03",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "保密性和加密",
+ "text": "確定應使用哪種/是否應使用用戶端加密。",
+ "waf": "安全"
+ },
+ {
+ "category": "安全",
+ "description": "利用 Resource Graph 資源管理器 （resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true） 查找允許匿名 blob 訪問的存儲帳戶。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "id": "A18.01",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "身份和訪問管理",
+ "text": "考慮是否需要公共 blob 匿名訪問，或者是否可以對某些存儲帳戶禁用公共 blob 匿名訪問。",
+ "waf": "安全"
+ },
+ {
+ "category": "運營管理",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "id": "B01.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "平臺版本",
+ "text": "利用 storagev2 帳戶類型獲得更好的性能和可靠性",
+ "waf": "可靠性"
+ },
+ {
+ "category": "BC 和DR",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "id": "C01.01",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
+ "severity": "高",
+ "subcategory": "可用性",
+ "text": "利用 GRS、ZRS 或 GZRS 儲存實現最高可用性",
+ "waf": "可靠性"
+ },
+ {
+ "category": "BC 和DR",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "id": "C01.02",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "故障轉移",
+ "text": "對於故障轉移后的寫入操作，請使用客戶管理的故障轉移",
+ "waf": "可靠性"
+ },
+ {
+ "category": "運營管理",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "id": "C01.03",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "故障轉移",
+ "text": "瞭解 Microsoft 託管的故障轉移詳細資訊",
+ "waf": "可靠性"
+ },
+ {
+ "category": "運營管理",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "id": "C01.04",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "subcategory": "數據保護",
+ "text": "啟用軟刪除",
+ "waf": "可靠性"
+ }
+ ],
+ "metadata": {
+ "name": "Azure Storage Review Checklist",
+ "state": "Preview",
+ "timestamp": "August 12, 2024",
+ "waf": "all"
+ },
+ "severities": [
+ {
+ "name": "高"
+ },
+ {
+ "name": "中等"
+ },
+ {
+ "name": "低"
+ }
+ ],
+ "status": [
+ {
+ "description": "此檢查尚未查看",
+ "name": "未驗證"
+ },
+ {
+ "description": "有一個與此檢查關聯的操作項",
+ "name": "打開"
+ },
+ {
+ "description": "此檢查已經過驗證，並且沒有與之關聯的其他操作項",
+ "name": "實現"
+ },
+ {
+ "description": "建議已理解，但當前要求不需要",
+ "name": "不需要"
+ },
+ {
+ "description": "不適用於當前設計",
+ "name": "N/A"
+ }
+ ],
+ "waf": [
+ {
+ "name": "可靠性"
+ },
+ {
+ "name": "安全"
+ },
+ {
+ "name": "成本"
+ },
+ {
+ "name": "操作"
+ },
+ {
+ "name": "性能"
+ }
+ ],
+ "yesno": [
+ {
+ "name": "是的"
+ },
+ {
+ "name": "不"
+ }
+ ]
+}
\ No newline at end of file
diff --git a/checklists/checklist.en.master.json b/checklists/checklist.en.master.json
index 9c9631f09..0afc6f098 100644
--- a/checklists/checklist.en.master.json
+++ b/checklists/checklist.en.master.json
@@ -1,5 +1,3539 @@
{
"items": [
+ {
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
+ "service": "Entra",
+ "services": [
+ "Entra"
+ ],
+ "severity": "Medium",
+ "subcategory": "Microsoft Entra ID Tenants",
+ "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.",
+ "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Entra",
+ "services": [
+ "Entra"
+ ],
+ "severity": "Low",
+ "subcategory": "Microsoft Entra ID Tenants",
+ "text": "Use Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants.",
+ "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "Entra",
+ "services": [
+ "Entra"
+ ],
+ "severity": "High",
+ "subcategory": "Microsoft Entra ID Tenants",
+ "text": "Use Azure Lighthouse for Multi-Tenant Management with the same IDs.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
+ "waf": "Operations"
+ },
+ {
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Entra",
+ "services": [
+ "Entra"
+ ],
+ "severity": "High",
+ "subcategory": "Cloud Solution Provider",
+ "text": "If you give a partner access to administer your tenant, use Azure Lighthouse.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
+ "waf": "Cost"
+ },
+ {
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a24d0de3-d4b9-4dfb-8ddd-bbfaf123fa01",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-cloud-solution-provider#design-recommendations",
+ "services": [
+ "Entra"
+ ],
+ "severity": "Low",
+ "subcategory": "Cloud Solution Provider",
+ "text": "If you have a CSP partner, define and document your support request and escalation process.",
+ "waf": "Cost"
+ },
+ {
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "32952499-58c8-4e6f-ada5-972e67893d55",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "services": [
+ "Entra",
+ "Cost"
+ ],
+ "severity": "Medium",
+ "subcategory": "Cloud Solution Provider",
+ "text": "Setup Cost Reporting and Views with Azure Cost Management.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/",
+ "waf": "Cost"
+ },
+ {
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "685cb4f2-ac9c-4b19-9167-993ed0b32415",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
+ "services": [
+ "Entra",
+ "LoadBalancer"
+ ],
+ "severity": "Medium",
+ "subcategory": "Enterprise Agreement",
+ "text": "Configure Notification Contacts to a group mailbox.",
+ "waf": "Cost"
+ },
+ {
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "12cd499f-96e2-4e41-a243-231fb3245a1c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "services": [
+ "Entra",
+ "TrafficManager"
+ ],
+ "severity": "Low",
+ "subcategory": "Enterprise Agreement",
+ "text": "Use departments and accounts to map your organization's structure to your enrollment hierarchy which can help with separating billing.",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/manage/understand-ea-roles",
+ "waf": "Cost"
+ },
+ {
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ca0fe401-12ad-46fc-8a7e-86293866a9f6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-recommendations",
+ "services": [
+ "Entra",
+ "Cost"
+ ],
+ "severity": "Medium",
+ "subcategory": "Enterprise Agreement",
+ "text": "Enable both DA View Charges and AO View Charges on your EA Enrollments to allow users with the correct perms review Cost and Billing Data.",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/assign-access-acm-data#enable-access-to-costs-in-the-azure-portal",
+ "waf": "Security"
+ },
+ {
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5cf9f485-2784-49b3-9824-75d9b8bdb57b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "services": [
+ "Entra",
+ "Cost",
+ "Subscriptions"
+ ],
+ "severity": "Low",
+ "subcategory": "Enterprise Agreement",
+ "text": "Use of Enterprise Dev/Test Subscriptions to reduce costs for non-production workloads.",
+ "training": "https://learn.microsoft.com/azure/devtest/offer/how-to-manage-monitor-devtest",
+ "waf": "Cost"
+ },
+ {
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6ad5c3dd-e5ea-4ff1-81a4-7886ff87845c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "services": [
+ "Entra"
+ ],
+ "severity": "Low",
+ "subcategory": "Microsoft Customer Agreement",
+ "text": "Configure Agreement billing account notification contact email.",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/manage/mca-setup-account",
+ "waf": "Cost"
+ },
+ {
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "90e87802-602f-4dfb-acea-67c60689f1d7",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/mca-section-invoice",
+ "services": [
+ "Entra",
+ "Storage",
+ "Cost"
+ ],
+ "severity": "Low",
+ "subcategory": "Microsoft Customer Agreement",
+ "text": "Use Billing Profiles and Invoice sections to structure your agreements billing for effective cost management.",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/understand/mca-overview#billing-profiles",
+ "waf": "Cost"
+ },
+ {
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e81a73f0-84c4-4641-b406-14db3b4d1f50",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "services": [
+ "Entra",
+ "Cost"
+ ],
+ "severity": "Low",
+ "subcategory": "Microsoft Customer Agreement",
+ "text": "Make use of Microsoft Azure plan for dev/test offer to reduce costs for non-production workloads.",
+ "training": "https://learn.microsoft.com/azure/devtest/offer/overview-what-is-devtest-offer-visual-studio",
+ "waf": "Cost"
+ },
+ {
+ "category": "Azure Billing and Microsoft Entra ID Tenants",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ae757485-92a4-482a-8bc9-eefe6f5b5ec3",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "services": [
+ "Entra",
+ "RBAC"
+ ],
+ "severity": "Medium",
+ "subcategory": "Microsoft Customer Agreement",
+ "text": "Define and document a process to periodically audit the agreement billing RBAC role assignments to review who has access to your MCA billing account.",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/manage/understand-mca-roles",
+ "waf": "Cost"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "348ef254-c27d-442e-abba-c7571559ab91",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
+ "service": "Entra",
+ "services": [
+ "Entra",
+ "RBAC",
+ "ACR",
+ "Subscriptions"
+ ],
+ "severity": "High",
+ "subcategory": "Identity",
+ "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4348bf81-7573-4512-8f46-9061cc198fea",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#identity-and-access-management-in-the-azure-landing-zone-accelerator",
+ "services": [
+ "Entra"
+ ],
+ "severity": "High",
+ "subcategory": "Microsoft Entra ID and Hybrid Identity",
+ "text": "Use managed identities instead of service principals for authentication to Azure services. You can check for existing service principals via Entra ID > Sign in Logs > Service principal logins.",
+ "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
+ "service": "Entra",
+ "services": [
+ "Entra"
+ ],
+ "severity": "High",
+ "subcategory": "Identity",
+ "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "Entra",
+ "services": [
+ "Entra"
+ ],
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
+ "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
+ "service": "Entra",
+ "services": [
+ "Entra",
+ "AzurePolicy"
+ ],
+ "severity": "High",
+ "subcategory": "Identity",
+ "text": "Enforce Microsoft Entra ID Conditional Access policies for any user with rights to Azure environments.",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
+ "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
+ "service": "Entra",
+ "services": [
+ "Entra"
+ ],
+ "severity": "High",
+ "subcategory": "Identity",
+ "text": "Enforce multi-factor authentication for any user with rights to the Azure environments.",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e6a83de5-de32-4c19-a248-1607d5d1e4e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
+ "services": [
+ "Entra",
+ "RBAC"
+ ],
+ "severity": "High",
+ "subcategory": "Identity",
+ "text": "Enforce centralized and delegated responsibilities to manage resources deployed inside the landing zone, based on role and security requirements.",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "Entra",
+ "services": [
+ "Entra"
+ ],
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1559ab91-53e8-4908-ae28-c84c33b6b780",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain#vm-recommendations",
+ "services": [
+ "VM",
+ "ACR",
+ "Entra"
+ ],
+ "severity": "High",
+ "subcategory": "Identity",
+ "text": "When deploying Active Directory Domain Controllers, use a location with Availability Zones and deploy at least two VMs across these zones. If not available, deploy in an Availability Set.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f5664b5e-984a-4859-a773-e7d261623a76",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
+ "services": [
+ "Entra",
+ "RBAC",
+ "ACR",
+ "Subscriptions"
+ ],
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Use Azure custom RBAC roles for the following key roles to provide fine-grain access across your ALZ: Azure platform owner, network management, security operations, subscription owner, application owner. Align these roles to teams and responsibilities within your business.",
+ "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
+ "services": [
+ "Entra"
+ ],
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "If planning to switch from Active Directory Domain Services to Entra domain services, evaluate the compatibility of all workloads.",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
+ "service": "Entra",
+ "services": [
+ "Entra",
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.",
+ "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
+ "waf": "Security"
+ },
+ {
+ "ammp": true,
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
+ "service": "Entra",
+ "services": [
+ "Entra"
+ ],
+ "severity": "High",
+ "subcategory": "Identity",
+ "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cd163e39-84a5-4b39-97b7-6973abd70d94",
+ "link": "https://learn.microsoft.com/azure/active-directory/hybrid/how-to-connect-sync-staging-server",
+ "services": [
+ "Entra",
+ "ASR"
+ ],
+ "severity": "Medium",
+ "subcategory": "Microsoft Entra ID",
+ "text": "When deploying Microsoft Entra Connect, use a staging sever for high availability/disaster recovery.",
+ "training": "https://learn.microsoft.com/entra/identity/hybrid/connect/plan-connect-topologies",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "35037e68-9349-4c15-b371-228514f4cdff",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "Entra",
+ "services": [
+ "Entra",
+ "RBAC"
+ ],
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "Do not use on-premises synced accounts for Microsoft Entra ID role assignments, unless you have a scenario that specifically requires it.",
+ "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Entra",
+ "services": [
+ "Entra"
+ ],
+ "severity": "Medium",
+ "subcategory": "Identity",
+ "text": "When using Microsoft Entra ID Application Proxy to give remote users access to applications, manage it as a Platform resource as you can only have one instance per tenant.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "9cf5418b-1520-4b7b-add7-88eb28f833e8",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#identity-and-access-management-in-the-azure-landing-zone-accelerator",
+ "services": [
+ "Entra",
+ "VNet"
+ ],
+ "severity": "High",
+ "subcategory": "Landing zones",
+ "text": "Configure Identity network segmentation through the use of a virtual Network and peer back to the hub. Providing authentication inside application landing zone (legacy).",
+ "training": "https://learn.microsoft.com/azure/architecture/example-scenario/identity/adds-extend-domain",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d4d1ad54-1abc-4919-b267-3f342d3b49e4",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#rbac-recommendations",
+ "services": [
+ "Storage",
+ "Entra",
+ "AKV",
+ "RBAC",
+ "ACR"
+ ],
+ "severity": "Medium",
+ "subcategory": "Landing zones",
+ "text": "Use Azure RBAC to manage data plane access to resources, if possible. E.g. Data Operations across Key Vault, Storage Account and Database Services.",
+ "training": "https://learn.microsoft.com/azure/role-based-access-control/overview",
+ "waf": "Security"
+ },
+ {
+ "category": "Identity and Access Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d505ebcb-79b1-4274-9c0d-a27c8bea489c",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-create-roles-and-resource-roles-review",
+ "services": [
+ "Entra"
+ ],
+ "severity": "Medium",
+ "subcategory": "Landing zones",
+ "text": "Use Microsoft Entra ID PIM access reviews to periodically validate resource entitlements.",
+ "training": "https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-perform-roles-and-resource-roles-review",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Consider using the Azure naming tool available at https://aka.ms/azurenamingtool",
+ "guid": "cacf55bc-e4e4-46be-96bc-57a5f23a269a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-naming",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Naming and tagging",
+ "text": "Use a well defined naming scheme for resources, such as Microsoft Best Practice Naming Standards.",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
+ "guid": "2df27ee4-12e7-4f98-9f63-04722dd69c5b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
+ "services": [
+ "Subscriptions"
+ ],
+ "severity": "Medium",
+ "subcategory": "Subscriptions",
+ "text": "Enforce reasonably flat management group hierarchy with no more than four levels.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "667313b4-f566-44b5-b984-a859c773e7d2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
+ "services": [
+ "Subscriptions"
+ ],
+ "severity": "Medium",
+ "subcategory": "Subscriptions",
+ "text": "Enforce a sandbox management group to allow users to immediately experiment with Azure.",
+ "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "61623a76-5a91-47e1-b348-ef254c27d42e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
+ "services": [
+ "RBAC",
+ "AzurePolicy",
+ "Subscriptions"
+ ],
+ "severity": "Medium",
+ "subcategory": "Subscriptions",
+ "text": "Enforce a platform management group under the root management group to support common platform policy and Azure role assignment.",
+ "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8bbac757-1559-4ab9-853e-8908ae28c84c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
+ "services": [
+ "DNS",
+ "ExpressRoute",
+ "Subscriptions",
+ "VWAN"
+ ],
+ "severity": "Medium",
+ "subcategory": "Subscriptions",
+ "text": "Enforce a dedicated connectivity subscription in the Connectivity management group to host an Azure Virtual WAN hub, private non-AD Domain Name System (DNS), ExpressRoute circuit, and other networking resources.",
+ "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1)",
+ "guid": "33b6b780-8b9f-4e5c-9104-9d403a923c34",
+ "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group",
+ "services": [
+ "Subscriptions"
+ ],
+ "severity": "Medium",
+ "subcategory": "Subscriptions",
+ "text": "Enforce no subscriptions are placed under the root management group.",
+ "training": "https://learn.microsoft.com/azure/governance/management-groups/overview",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "74d00018-ac6a-49e0-8e6a-83de5de32c19",
+ "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization",
+ "services": [
+ "RBAC",
+ "Subscriptions"
+ ],
+ "severity": "Medium",
+ "subcategory": "Subscriptions",
+ "text": "Enforce that only privileged users can operate management groups in the tenant by enabling Azure RBAC authorization in the management group hierarchy settings.",
+ "training": "https://learn.microsoft.com/training/modules/configure-role-based-access-control/",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "92481607-d5d1-4e4e-9146-58d3558fd772",
+ "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
+ "services": [
+ "Subscriptions"
+ ],
+ "severity": "Medium",
+ "subcategory": "Subscriptions",
+ "text": "Enforce management groups under the root-level management group to represent the types of workloads, based on their security, compliance, connectivity, and feature needs.",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "49b82111-2df2-47ee-912e-7f983f630472",
+ "link": "https://learn.microsoft.com/entra/id-governance/access-reviews-overview",
+ "services": [
+ "RBAC",
+ "Cost",
+ "AzurePolicy",
+ "Subscriptions"
+ ],
+ "severity": "High",
+ "subcategory": "Subscriptions",
+ "text": "Enforce a process to make resource owners aware of their roles and responsibilities, access review, budget review, policy compliance and remediate when necessary.",
+ "training": "https://learn.microsoft.com/training/modules/plan-implement-manage-access-review/",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2dd69c5b-5c26-422f-94b6-9bad33aad5e8",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "services": [
+ "Subscriptions"
+ ],
+ "severity": "Medium",
+ "subcategory": "Subscriptions",
+ "text": "Ensure that all subscription owners and IT core team are aware of subscription quotas and the impact they have on provision resources for a given subscription.",
+ "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c68e1d76-6673-413b-9f56-64b5e984a859",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/save-compute-costs-reservations",
+ "services": [
+ "Cost",
+ "Subscriptions"
+ ],
+ "severity": "High",
+ "subcategory": "Subscriptions",
+ "text": "Use Reserved Instances where appropriate to optimize cost and ensure available capacity in target regions.",
+ "training": "https://learn.microsoft.com/learn/paths/improve-reliability-modern-operations/",
+ "waf": "Security"
+ },
+ {
+ "ammp": true,
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c773e7d2-6162-43a7-95a9-17e1f348ef25",
+ "link": "https://learn.microsoft.com/azure/azure-portal/azure-portal-dashboards",
+ "services": [
+ "Monitor",
+ "Storage",
+ "Subscriptions"
+ ],
+ "severity": "Medium",
+ "subcategory": "Subscriptions",
+ "text": "Establish dashboards and/or visualizations to monitor compute and storage capacity metrics. (i.e. CPU, memory, disk space)",
+ "training": "https://learn.microsoft.com/training/modules/visualize-data-workbooks/",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ae28c84c-33b6-4b78-88b9-fe5c41049d40",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/get-started/manage-costs",
+ "services": [
+ "Cost",
+ "Subscriptions"
+ ],
+ "severity": "High",
+ "subcategory": "Subscriptions",
+ "text": "As part of your cloud adoption, implement a detailed cost management plan using the 'Managed cloud costs' process.",
+ "training": "https://learn.microsoft.com/learn/paths/control-spending-manage-bills/",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3a923c34-74d0-4001-aac6-a9e01e6a83de",
+ "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
+ "services": [
+ "Entra",
+ "Subscriptions"
+ ],
+ "severity": "Medium",
+ "subcategory": "Subscriptions",
+ "text": "If servers will be used for Identity services, like domain controllers, establish a dedicated identity subscription in the identity management group, to host these services. Make sure that resources are set to use the domain controllers available in their region.",
+ "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
+ "guid": "5de32c19-9248-4160-9d5d-1e4e614658d3",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs",
+ "services": [
+ "Cost",
+ "Subscriptions"
+ ],
+ "severity": "Medium",
+ "subcategory": "Subscriptions",
+ "text": "Ensure tags are used for billing and cost management.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6cc0ea22-42bb-441e-a345-804ab0a09666",
+ "link": "https://github.com/Azure/sovereign-landing-zone/blob/main/docs/02-Architecture.md",
+ "services": [
+ "Subscriptions"
+ ],
+ "severity": "Medium",
+ "subcategory": "Subscriptions",
+ "text": "For Sovereign Landing Zone, have a 'confidential corp' and 'confidential online' management group directly under the 'landing zones' MG.",
+ "training": "https://learn.microsoft.com/industry/sovereignty/slz-overview",
+ "waf": "Security"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "250d81ce-8bbe-4f85-9051-6a18a8221e50",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/regions",
+ "services": [
+ "Cost"
+ ],
+ "severity": "High",
+ "subcategory": "Regions",
+ "text": "Select the right Azure region/s for your deployment. Azure is a global-scale cloud platform that provide global coverage through many regions and geographies. Different Azure regions have different characteristics, access and availability models, costs, capacity, and services offered, then it is important to consider all criteria and requirements.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "19ca3f89-397d-44b1-b5b6-5e18661372ac",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/regions#operate-in-multiple-geographic-regions",
+ "services": [
+ "ASR"
+ ],
+ "severity": "Medium",
+ "subcategory": "Regions",
+ "text": "Deploy your Azure landing zone in a multi-region deployment. Depending on customer size, locations, and users presence, operating in multiple regions can be a common choice to deliver services and run applications closer to them. Using a multi-region deployment is also important to provide geo disaster recovery capabilities, to eliminate the dependency from a single region capacity and diminish the risk of a temporary and localized resource capacity constraint.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Resource Organization",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4c27d42e-8bba-4c75-9155-9ab9153e8908",
+ "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Regions",
+ "text": "Ensure required services and features are available within the chosen deployment regions.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "373f482f-3e39-4d39-8aa4-7e566f6082b6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-app-delivery",
+ "services": [
+ "AppGW",
+ "FrontDoor"
+ ],
+ "severity": "Medium",
+ "subcategory": "App delivery",
+ "text": "Document a standard for securing the delivery application content from your Workload spokes using Application Gateway and Azure Front Door. You can use the Application Delivery checklist to for recommendations.",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
+ "service": "VNet",
+ "services": [
+ "VNet"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hub and spoke",
+ "text": "Use a hub-and-spoke network topology for network scenarios that require maximum flexibility.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
+ "service": "VNet",
+ "services": [
+ "Entra",
+ "Firewall",
+ "NVA",
+ "VNet",
+ "ExpressRoute",
+ "DNS",
+ "VPN"
+ ],
+ "severity": "High",
+ "subcategory": "Hub and spoke",
+ "text": "Deploy shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS services.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Cost"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "VNet",
+ "services": [
+ "DDoS"
+ ],
+ "severity": "High",
+ "subcategory": "App delivery",
+ "text": "Use a DDoS Network or IP protection plan for all public IP addresses in application landing zones.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
+ "service": "NVA",
+ "services": [
+ "NVA"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hub and spoke",
+ "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance.",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute",
+ "ARS",
+ "VPN"
+ ],
+ "severity": "Low",
+ "subcategory": "Hub and spoke",
+ "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
+ "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
+ "service": "ARS",
+ "services": [
+ "VNet",
+ "ARS"
+ ],
+ "severity": "Low",
+ "subcategory": "Hub and spoke",
+ "text": "If using Route Server, use a /27 prefix for the Route Server subnet.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
+ "service": "VNet",
+ "services": [
+ "ACR",
+ "VNet"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hub and spoke",
+ "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
+ "service": "VNet",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hub and spoke",
+ "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
+ "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
+ "services": [
+ "VNet",
+ "ExpressRoute"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hub and spoke",
+ "text": "If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000).",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
+ "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
+ "services": [
+ "Storage"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hub and spoke",
+ "text": "Limit the number of routes per route table to 400.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
+ "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
+ "service": "VNet",
+ "services": [
+ "VNet"
+ ],
+ "severity": "High",
+ "subcategory": "Hub and spoke",
+ "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute"
+ ],
+ "severity": "Medium",
+ "subcategory": "Encryption",
+ "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute",
+ "VPN"
+ ],
+ "severity": "Medium",
+ "subcategory": "Encryption",
+ "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "ExpressRoute",
+ "services": [
+ "VNet",
+ "ACR"
+ ],
+ "severity": "High",
+ "subcategory": "IP plan",
+ "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
+ "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
+ "services": [
+ "VNet"
+ ],
+ "severity": "Medium",
+ "subcategory": "IP plan",
+ "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
+ "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
+ "services": [
+ "VNet"
+ ],
+ "severity": "High",
+ "subcategory": "IP plan",
+ "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16).",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
+ "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
+ "service": "VNet",
+ "services": [
+ "ASR",
+ "VNet"
+ ],
+ "severity": "High",
+ "subcategory": "IP plan",
+ "text": "Do not use overlapping IP address ranges for production and disaster recovery sites.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
+ "service": "DNS",
+ "services": [
+ "DNS",
+ "VNet"
+ ],
+ "severity": "Medium",
+ "subcategory": "IP plan",
+ "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
+ "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
+ "service": "DNS",
+ "services": [
+ "VNet",
+ "DNS",
+ "ACR"
+ ],
+ "severity": "Medium",
+ "subcategory": "IP plan",
+ "text": "For environments where name resolution across Azure and on-premises is required and there is no existing enterprise DNS service like Active Directory, use Azure DNS Private Resolver to route DNS requests to Azure or to on-premises DNS servers.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
+ "service": "DNS",
+ "services": [
+ "DNS",
+ "VNet"
+ ],
+ "severity": "Low",
+ "subcategory": "IP plan",
+ "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "614658d3-558f-4d77-849b-821112df27ee",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
+ "service": "DNS",
+ "services": [
+ "VM",
+ "DNS",
+ "VNet"
+ ],
+ "severity": "High",
+ "subcategory": "IP plan",
+ "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
+ "service": "Bastion",
+ "services": [
+ "Bastion"
+ ],
+ "severity": "Medium",
+ "subcategory": "Internet",
+ "text": "Use Azure Bastion to securely connect to your network.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
+ "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
+ "service": "Bastion",
+ "services": [
+ "Bastion",
+ "VNet"
+ ],
+ "severity": "Medium",
+ "subcategory": "Internet",
+ "text": "Use Azure Bastion in a subnet /26 or larger.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "WAF",
+ "services": [
+ "ACR",
+ "FrontDoor",
+ "WAF",
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "subcategory": "Internet",
+ "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
+ "services": [
+ "AppGW",
+ "AzurePolicy",
+ "FrontDoor",
+ "WAF"
+ ],
+ "severity": "Low",
+ "subcategory": "Internet",
+ "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
+ "services": [
+ "VNet",
+ "WAF"
+ ],
+ "severity": "High",
+ "subcategory": "Internet",
+ "text": "When WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "services": [
+ "VNet",
+ "DDoS"
+ ],
+ "severity": "High",
+ "subcategory": "Internet",
+ "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
+ "service": "VNet",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Internet",
+ "text": "Plan for how to manage your network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "services": [
+ "DDoS"
+ ],
+ "severity": "High",
+ "subcategory": "Internet",
+ "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
+ "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
+ "service": "Policy",
+ "services": [
+ "VM",
+ "AzurePolicy"
+ ],
+ "severity": "High",
+ "subcategory": "Internet",
+ "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines. Use exclusions if public IPs are needed on specific VMs.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute",
+ "VPN",
+ "Backup"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Use ExpressRoute as the primary connection to Azure. Use VPNs as a source of backup connectivity.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.",
+ "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "When you use multiple ExpressRoute circuits or multiple on-prem locations, use BGP attributes to optimize routing.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
+ "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute",
+ "VPN"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
+ "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
+ "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
+ "service": "ExpressRoute",
+ "services": [
+ "Cost",
+ "ExpressRoute"
+ ],
+ "severity": "High",
+ "subcategory": "Hybrid",
+ "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
+ "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
+ "service": "ExpressRoute",
+ "services": [
+ "Cost",
+ "ExpressRoute"
+ ],
+ "severity": "High",
+ "subcategory": "Hybrid",
+ "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
+ "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
+ "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
+ "service": "VPN",
+ "services": [
+ "VPN"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
+ "service": "VPN",
+ "services": [
+ "VPN"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Use redundant VPN appliances on-premises (active/active or active/passive).",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
+ "service": "ExpressRoute",
+ "services": [
+ "Cost",
+ "ExpressRoute"
+ ],
+ "severity": "High",
+ "subcategory": "Hybrid",
+ "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
+ "service": "ExpressRoute",
+ "services": [
+ "Monitor",
+ "ExpressRoute"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
+ "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
+ "service": "ExpressRoute",
+ "services": [
+ "Monitor",
+ "ACR",
+ "NetworkWatcher"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
+ "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Use ExpressRoute circuits from different peering locations for redundancy.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute",
+ "VPN"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Use site-to-site VPN as failover of ExpressRoute, if only using a single ExpressRoute circuit.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
+ "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
+ "service": "ExpressRoute",
+ "services": [
+ "Storage",
+ "VNet"
+ ],
+ "severity": "High",
+ "subcategory": "Hybrid",
+ "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d581a947-69a2-4783-942e-9df3664324c8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
+ "service": "ExpressRoute",
+ "services": [
+ "ACR",
+ "ExpressRoute"
+ ],
+ "severity": "High",
+ "subcategory": "Hybrid",
+ "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
+ "service": "ExpressRoute",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute"
+ ],
+ "severity": "High",
+ "subcategory": "Hybrid",
+ "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
+ "service": "ExpressRoute",
+ "services": [
+ "Monitor",
+ "VNet",
+ "ExpressRoute"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
+ "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
+ "service": "ExpressRoute",
+ "services": [
+ "VNet",
+ "ExpressRoute"
+ ],
+ "severity": "Medium",
+ "subcategory": "Hybrid",
+ "text": "Do not use ExpressRoute circuits for VNet-to-VNet communication.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "service": "N/A",
+ "services": [
+ "ACR"
+ ],
+ "severity": "Low",
+ "subcategory": "Hybrid",
+ "text": "Do not send Azure traffic to hybrid locations for inspection. Instead, follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network.",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
+ "link": "https://learn.microsoft.com/azure/firewall/overview",
+ "service": "Firewall",
+ "services": [
+ "Firewall"
+ ],
+ "severity": "High",
+ "subcategory": "Firewall",
+ "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
+ "service": "Firewall",
+ "services": [
+ "RBAC",
+ "ACR",
+ "Firewall",
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "subcategory": "Firewall",
+ "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
+ "service": "Firewall",
+ "services": [
+ "Firewall"
+ ],
+ "severity": "Low",
+ "subcategory": "Firewall",
+ "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
+ "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
+ "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
+ "service": "Firewall",
+ "services": [
+ "DNS",
+ "Firewall"
+ ],
+ "severity": "High",
+ "subcategory": "Firewall",
+ "text": "Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
+ "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features",
+ "service": "Firewall",
+ "services": [
+ "Firewall"
+ ],
+ "severity": "High",
+ "subcategory": "Firewall",
+ "text": "Use Azure Firewall Premium to enable additional security features.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
+ "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
+ "service": "Firewall",
+ "services": [
+ "Firewall"
+ ],
+ "severity": "High",
+ "subcategory": "Firewall",
+ "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
+ "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
+ "service": "Firewall",
+ "services": [
+ "Firewall"
+ ],
+ "severity": "High",
+ "subcategory": "Firewall",
+ "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
+ "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
+ "service": "Firewall",
+ "services": [
+ "Storage",
+ "Firewall",
+ "NVA",
+ "VNet",
+ "VWAN"
+ ],
+ "severity": "High",
+ "subcategory": "Firewall",
+ "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance.",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
+ "service": "Firewall",
+ "services": [
+ "Storage",
+ "Firewall"
+ ],
+ "severity": "Medium",
+ "subcategory": "Firewall",
+ "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
+ "service": "Firewall",
+ "services": [
+ "AzurePolicy",
+ "Firewall"
+ ],
+ "severity": "Important",
+ "subcategory": "Firewall",
+ "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
+ "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
+ "service": "Firewall",
+ "services": [
+ "VNet",
+ "Firewall"
+ ],
+ "severity": "High",
+ "subcategory": "Segmentation",
+ "text": "Use a /26 prefix for your Azure Firewall subnets.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
+ "service": "Firewall",
+ "services": [
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "subcategory": "Firewall",
+ "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
+ "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
+ "service": "Firewall",
+ "services": [
+ "Storage"
+ ],
+ "severity": "Medium",
+ "subcategory": "Firewall",
+ "text": "Use IP Groups or IP prefixes to reduce number of IP table rules.",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
+ "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
+ "service": "Firewall",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Firewall",
+ "text": "Do not use wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
+ "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
+ "service": "Firewall",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Firewall",
+ "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "346840b8-1064-496e-8396-4b1340172d52",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
+ "service": "Firewall",
+ "services": [
+ "Firewall"
+ ],
+ "severity": "High",
+ "subcategory": "Firewall",
+ "text": "If you are using Azure Firewall Premium, enable TLS Inspection.",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
+ "service": "Firewall",
+ "services": [
+ "ServiceBus"
+ ],
+ "severity": "Low",
+ "subcategory": "Firewall",
+ "text": "Use web categories to allow or deny outbound access to specific topics.",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
+ "service": "Firewall",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Firewall",
+ "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
+ "link": "https://learn.microsoft.com/azure/firewall/dns-details",
+ "service": "Firewall",
+ "services": [
+ "DNS",
+ "Firewall"
+ ],
+ "severity": "Medium",
+ "subcategory": "Firewall",
+ "text": "Enable Azure Firewall DNS proxy configuration.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
+ "service": "Firewall",
+ "services": [
+ "Monitor",
+ "Firewall"
+ ],
+ "severity": "High",
+ "subcategory": "Firewall",
+ "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
+ "service": "Firewall",
+ "services": [
+ "Backup"
+ ],
+ "severity": "Low",
+ "subcategory": "Firewall",
+ "text": "Implement backups for your firewall rules",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "App Gateway",
+ "services": [
+ "VNet"
+ ],
+ "severity": "High",
+ "subcategory": "PaaS",
+ "text": "Do not disrupt control-plane communication for Azure PaaS services injected into a virtual networks, such as with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e43a58a9-c229-49c4-b7b5-7d0c655562f2",
+ "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
+ "services": [
+ "PrivateLink"
+ ],
+ "severity": "Medium",
+ "subcategory": "PaaS",
+ "text": "Use Private Link, where available, for shared Azure PaaS services.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
+ "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute",
+ "PrivateLink"
+ ],
+ "severity": "Medium",
+ "subcategory": "PaaS",
+ "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
+ "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
+ "service": "VNet",
+ "services": [
+ "VNet"
+ ],
+ "severity": "High",
+ "subcategory": "PaaS",
+ "text": "Don't enable virtual network service endpoints by default on all subnets.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
+ "link": "azure/private-link/inspect-traffic-with-azure-firewall",
+ "service": "Firewall",
+ "services": [
+ "DNS",
+ "NVA",
+ "Firewall",
+ "PrivateLink"
+ ],
+ "severity": "Medium",
+ "subcategory": "PaaS",
+ "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
+ "service": "ExpressRoute",
+ "services": [
+ "ExpressRoute",
+ "VNet",
+ "VPN"
+ ],
+ "severity": "High",
+ "subcategory": "Segmentation",
+ "text": "Use at least a /27 prefix for your Gateway subnets.",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
+ "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
+ "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
+ "service": "NSG",
+ "services": [
+ "VNet"
+ ],
+ "severity": "High",
+ "subcategory": "Segmentation",
+ "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c2447ec6-6138-4a72-80f1-ce16ed301d6e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
+ "services": [
+ "VNet"
+ ],
+ "severity": "Medium",
+ "subcategory": "Segmentation",
+ "text": "Delegate subnet creation to the landing zone owner.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
+ "service": "NSG",
+ "services": [
+ "ACR",
+ "VNet"
+ ],
+ "severity": "Medium",
+ "subcategory": "Segmentation",
+ "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "NSG",
+ "services": [
+ "Entra",
+ "NVA",
+ "VNet"
+ ],
+ "severity": "Medium",
+ "subcategory": "Segmentation",
+ "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
+ "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
+ "service": "NSG",
+ "services": [
+ "VNet",
+ "NetworkWatcher"
+ ],
+ "severity": "Medium",
+ "subcategory": "Segmentation",
+ "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
+ "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "NSG",
+ "services": [
+ "VNet"
+ ],
+ "severity": "Medium",
+ "subcategory": "Segmentation",
+ "text": "Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules.",
+ "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
+ "service": "VWAN",
+ "services": [
+ "VWAN"
+ ],
+ "severity": "Medium",
+ "subcategory": "Virtual WAN",
+ "text": "Use Virtual WAN if your scenario is explicitly described in the list of Virtual WAN routing designs.",
+ "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
+ "service": "VWAN",
+ "services": [
+ "ACR",
+ "VWAN"
+ ],
+ "severity": "Medium",
+ "subcategory": "Virtual WAN",
+ "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Performance"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
+ "service": "VWAN",
+ "services": [
+ "VWAN",
+ "Firewall"
+ ],
+ "severity": "Medium",
+ "subcategory": "Virtual WAN",
+ "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
+ "service": "VWAN",
+ "services": [
+ "VWAN"
+ ],
+ "severity": "Medium",
+ "subcategory": "Virtual WAN",
+ "text": "Ensure that your virtual WAN network architecture aligns to an identified architecture scenario.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
+ "service": "VWAN",
+ "services": [
+ "Monitor",
+ "VWAN"
+ ],
+ "severity": "Medium",
+ "subcategory": "Virtual WAN",
+ "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
+ "service": "VWAN",
+ "services": [
+ "VWAN"
+ ],
+ "severity": "Medium",
+ "subcategory": "Virtual WAN",
+ "text": "Do not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
+ "service": "VWAN",
+ "services": [
+ "VWAN",
+ "ExpressRoute",
+ "VPN"
+ ],
+ "severity": "Medium",
+ "subcategory": "Virtual WAN",
+ "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
+ "service": "VWAN",
+ "services": [
+ "VWAN"
+ ],
+ "severity": "Medium",
+ "subcategory": "Virtual WAN",
+ "text": "Configure label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Network Topology and Connectivity",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "9c75dfef-573c-461c-a698-68598595581a",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
+ "service": "VWAN",
+ "services": [
+ "VWAN"
+ ],
+ "severity": "High",
+ "subcategory": "Virtual WAN",
+ "text": "Assign at least a /23 prefix to virtual hubs to ensure enough IP space is available.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy"
+ ],
+ "severity": "High",
+ "subcategory": "Governance",
+ "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "services": [
+ "RBAC",
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "subcategory": "Governance",
+ "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy",
+ "Subscriptions"
+ ],
+ "severity": "Medium",
+ "subcategory": "Governance",
+ "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes.",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy"
+ ],
+ "severity": "High",
+ "subcategory": "Governance",
+ "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "43334f24-9116-4341-a2ba-527526944008",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy",
+ "Subscriptions"
+ ],
+ "severity": "Low",
+ "subcategory": "Governance",
+ "text": "Use Azure Policy to control which services users can provision at the subscription/management group level.",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy"
+ ],
+ "severity": "High",
+ "subcategory": "Governance",
+ "text": "Use built-in policies where possible to minimize operational overhead.",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.",
+ "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
+ "service": "Policy",
+ "services": [
+ "Entra",
+ "RBAC",
+ "AzurePolicy",
+ "Subscriptions"
+ ],
+ "severity": "Medium",
+ "subcategory": "Governance",
+ "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "19048384-5c98-46cb-8913-156a12476e49",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy",
+ "Subscriptions"
+ ],
+ "severity": "Medium",
+ "subcategory": "Governance",
+ "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
+ "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "subcategory": "Governance",
+ "text": "If any data sovereignty requirements exist, Azure Policies should be deployed to enforce them.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy",
+ "Subscriptions"
+ ],
+ "severity": "Medium",
+ "subcategory": "Governance",
+ "text": "For Sovereign Landing Zone, deploy sovereignty policy baseline and assign at correct management group level.",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "subcategory": "Governance",
+ "text": "For Sovereign Landing Zone, document Sovereign Control objectives to policy mapping.",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
+ "service": "Policy",
+ "services": [
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "subcategory": "Governance",
+ "text": "For Sovereign Landing Zone, ensure process is in place for management of 'Sovereign Control objectives to policy mapping'.",
+ "waf": "Security"
+ },
+ {
+ "category": "Governance",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "29fd366b-a180-452b-9bd7-954b7700c667",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets?bc=%2Fazure%2Fcloud-adoption-framework%2F_bread%2Ftoc.json&toc=%2Fazure%2Fcloud-adoption-framework%2Ftoc.json",
+ "services": [
+ "Monitor",
+ "Cost",
+ "TrafficManager"
+ ],
+ "severity": "Medium",
+ "subcategory": "Optimize your cloud investment",
+ "text": "Configure 'Actual' and 'Forecasted' Budget Alerts.",
+ "waf": "Cost"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
+ "services": [
+ "Entra",
+ "RBAC",
+ "Monitor",
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Monitor",
+ "services": [
+ "Monitor",
+ "Storage",
+ "ARS",
+ "AzurePolicy"
+ ],
+ "severity": "High",
+ "subcategory": "Monitoring",
+ "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
+ "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
+ "service": "VM",
+ "services": [
+ "VM",
+ "Monitor",
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
+ "service": "VM",
+ "services": [
+ "VM"
+ ],
+ "severity": "Medium",
+ "subcategory": "Operational compliance",
+ "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
+ "service": "VM",
+ "services": [
+ "VM"
+ ],
+ "severity": "Medium",
+ "subcategory": "Operational compliance",
+ "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "90483845-c986-4cb2-a131-56a12476e49f",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Network Watcher",
+ "services": [
+ "Monitor",
+ "NetworkWatcher"
+ ],
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Use Network Watcher to proactively monitor traffic flows.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "541acdce-9793-477b-adb3-751ab2ab13ad",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Use resource locks to prevent accidental deletion of critical shared services.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a6e55d7d-8a2a-4db1-87d6-326af625ca44",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/effect-deny",
+ "services": [
+ "Monitor",
+ "RBAC",
+ "AzurePolicy"
+ ],
+ "severity": "Low",
+ "subcategory": "Monitoring",
+ "text": "Use deny policies to supplement Azure role assignments. The combination of deny policies and Azure role assignments ensures the appropriate guardrails are in place to enforce who can deploy and configure resources and what resources they can deploy and configure.",
+ "training": "https://learn.microsoft.com/azure/role-based-access-control/deny-assignments?tabs=azure-portal",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e5695f22-23ac-4e8c-a123-08ca5017f154",
+ "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Include service and resource health events as part of the overall platform monitoring solution. Tracking service and resource health from the platform perspective is an important component of resource management in Azure.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-service-health/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d5f345bf-97ab-41a7-819c-6104baa7d48c",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Include alerts and action groups as part of the Azure Service Health platform to ensure that alerts or issues can be actioned.",
+ "training": "https://learn.microsoft.com/en-gb/training/modules/incident-response-with-alerting-on-azure/7-actions-and-alert-processing-rules",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e3ab3693-829e-47e3-8618-3687a0477a20",
+ "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Don't send raw log entries back to on-premises monitoring systems. Instead, adopt a principle that data born in Azure stays in Azure. If on-premises SIEM integration is required, then send critical alerts instead of logs.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/logging-and-reporting/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Monitor",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Use Azure Monitor Logs for insights and reporting.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "619e8a13-f988-4795-85d6-26886d70ba6c",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/agents/diagnostics-extension-overview",
+ "services": [
+ "Monitor",
+ "Storage"
+ ],
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "When necessary, use shared storage accounts within the landing zone for Azure diagnostic extension log storage.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-extensions/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
+ "service": "Monitor",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Use Azure Monitor alerts for the generation of operational alerts.",
+ "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "859c3900-4514-41eb-b010-475d695abd74",
+ "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Ensure that monitoring requirements have been assessed and that appropriate data collection and alerting configurations are applied.",
+ "training": "https://learn.microsoft.com/training/paths/az-104-monitor-backup-resources/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "Monitor",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "aa45be6a-8f2d-4896-b0e3-775e6e94e610",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-monitor",
+ "services": [
+ "Monitor",
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "subcategory": "Monitoring",
+ "text": "Deploy AMBA to establish monitoring for platform components of your landing zone - AMBA is a framework solution that is available and provides an easy way to scale alerting by using Azure Policy.",
+ "training": "https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7ea02e1c-7166-45a3-bdf5-098891367fcb",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Data Protection",
+ "text": "Enable cross-region replication in Azure for BCDR with paired regions.",
+ "training": "https://learn.microsoft.com/training/modules/provide-disaster-recovery-replicate-storage-data/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Backup",
+ "services": [
+ "Backup"
+ ],
+ "severity": "Low",
+ "subcategory": "Data Protection",
+ "text": "When using Azure Backup, use the correct backup types (GRS, ZRS & LRS) for your backup, as the default setting is GRS.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "Reliability"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "VM",
+ "services": [
+ "VM",
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "subcategory": "Operational compliance",
+ "text": "Use Azure guest policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.",
+ "waf": "Security"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Use Azure Policy's guest configuration features to audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.",
+ "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "VM",
+ "services": [
+ "VM",
+ "Monitor",
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "subcategory": "Operational compliance",
+ "text": "Monitor VM security configuration drift via Azure Policy.",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "VM",
+ "services": [
+ "VM",
+ "ASR",
+ "ACR"
+ ],
+ "severity": "Medium",
+ "subcategory": "Protect and Recover",
+ "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.",
+ "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b2ab13ad-a6e5-45d7-b8a2-adb117d6326a",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
+ "services": [
+ "ASR"
+ ],
+ "severity": "Medium",
+ "subcategory": "Protect and Recover",
+ "text": "Use native PaaS service disaster recovery capabilities. Perform failover testing with these capabilities.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/explore-iaas-paas-platform-tools-for-high-availability-disaster-recovery/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "Backup",
+ "services": [
+ "Backup"
+ ],
+ "severity": "Medium",
+ "subcategory": "Protect and Recover",
+ "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "WAF",
+ "services": [
+ "AppGW",
+ "WAF",
+ "FrontDoor"
+ ],
+ "severity": "High",
+ "subcategory": "App delivery",
+ "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.",
+ "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Management",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "WAF",
+ "services": [
+ "Sentinel",
+ "AppGW",
+ "WAF",
+ "FrontDoor"
+ ],
+ "severity": "Medium",
+ "subcategory": "App delivery",
+ "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.",
+ "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b86ad884-08e3-4727-94b8-75ba18f20459",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Access control",
+ "text": "Determine the incident response plan for Azure services before allowing it into production.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-incident-readiness/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "01365d38-e43f-49cc-ad86-8266abca264f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/security-zero-trust",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Access control",
+ "text": "Apply a zero-trust approach for access to the Azure platform.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-zero-trust-best-practice-frameworks/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5017f154-e3ab-4369-9829-e7e316183687",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "Key Vault",
+ "services": [
+ "AKV"
+ ],
+ "severity": "High",
+ "subcategory": "Encryption and keys",
+ "text": "Use Azure Key Vault to store your secrets and credentials.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
+ "guid": "a0477a20-9945-4bda-9333-4f2491163418",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
+ "service": "Key Vault",
+ "services": [
+ "AKV"
+ ],
+ "severity": "Medium",
+ "subcategory": "Encryption and keys",
+ "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "services": [
+ "AzurePolicy",
+ "AKV"
+ ],
+ "severity": "Medium",
+ "subcategory": "Encryption and keys",
+ "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "services": [
+ "Entra",
+ "RBAC",
+ "AKV"
+ ],
+ "severity": "Medium",
+ "subcategory": "Encryption and keys",
+ "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "services": [
+ "AKV"
+ ],
+ "severity": "Medium",
+ "subcategory": "Encryption and keys",
+ "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "913156a1-2476-4e49-b541-acdce979377b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "services": [
+ "AKV"
+ ],
+ "severity": "Medium",
+ "subcategory": "Encryption and keys",
+ "text": "Establish an automated process for key and certificate rotation.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "services": [
+ "VNet",
+ "AKV",
+ "PrivateLink"
+ ],
+ "severity": "Medium",
+ "subcategory": "Encryption and keys",
+ "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
+ "service": "Key Vault",
+ "services": [
+ "Entra",
+ "Monitor",
+ "AKV"
+ ],
+ "severity": "Medium",
+ "subcategory": "Encryption and keys",
+ "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "services": [
+ "AzurePolicy",
+ "AKV"
+ ],
+ "severity": "Medium",
+ "subcategory": "Encryption and keys",
+ "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "16183687-a047-47a2-8994-5bda43334f24",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/encryption-atrest",
+ "services": [
+ "AKV"
+ ],
+ "severity": "Medium",
+ "subcategory": "Encryption and keys",
+ "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "services": [
+ "AKV"
+ ],
+ "severity": "Medium",
+ "subcategory": "Encryption and keys",
+ "text": "Use an Azure Key Vault per application per environment per region.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "services": [
+ "ASR",
+ "ACR",
+ "AKV"
+ ],
+ "severity": "Medium",
+ "subcategory": "Encryption and keys",
+ "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
+ "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
+ "service": "Key Vault",
+ "services": [
+ "AKV"
+ ],
+ "severity": "Medium",
+ "subcategory": "Encryption and keys",
+ "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
+ "service": "Entra",
+ "services": [
+ "Entra"
+ ],
+ "severity": "Medium",
+ "subcategory": "Operations",
+ "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.",
+ "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4e3ab369-3829-4e7e-9161-83687a0477a2",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal",
+ "services": [
+ "Monitor",
+ "Storage",
+ "ARS"
+ ],
+ "severity": "Medium",
+ "subcategory": "Operations",
+ "text": "Export Azure activity logs to Azure Monitor Logs for long-term data retention. Export to Azure Storage for long-term storage beyond two years, if necessary.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "09945bda-4333-44f2-9911-634182ba5275",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
+ "service": "Defender",
+ "services": [
+ "Defender",
+ "Subscriptions"
+ ],
+ "severity": "High",
+ "subcategory": "Operations",
+ "text": "Enable Defender Cloud Security Posture Management for all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
+ "service": "Defender",
+ "services": [
+ "Defender",
+ "Subscriptions"
+ ],
+ "severity": "High",
+ "subcategory": "Operations",
+ "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
+ "service": "Defender",
+ "services": [
+ "Defender",
+ "Subscriptions"
+ ],
+ "severity": "High",
+ "subcategory": "Operations",
+ "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
+ "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
+ "service": "VM",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Operations",
+ "text": "Enable Endpoint Protection on IaaS Servers.",
+ "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
+ "link": "https://learn.microsoft.com/azure/security-center/",
+ "service": "VM",
+ "services": [
+ "Defender",
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Operations",
+ "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.",
+ "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
+ "services": [
+ "Entra",
+ "Monitor"
+ ],
+ "severity": "Medium",
+ "subcategory": "Operations",
+ "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
+ "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
+ "service": "Entra",
+ "services": [
+ "Entra"
+ ],
+ "severity": "Medium",
+ "subcategory": "Operations",
+ "text": "For Sovereign Landing Zone, enable transparancy logs on the Entra ID tenant.",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
+ "service": "Entra",
+ "services": [
+ "Entra"
+ ],
+ "severity": "Medium",
+ "subcategory": "Operations",
+ "text": "For Sovereign Landing Zone, enable customer Lockbox on the Entra ID tenant.",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "874a748b-662d-46d1-9051-2a66498f6dfe",
+ "link": "https://learn.microsoft.com/azure/event-grid/set-alerts",
+ "services": [
+ "Monitor"
+ ],
+ "severity": "Low",
+ "subcategory": "Operations",
+ "text": "Use an Azure Event Grid-based solution for log-oriented, real-time alerts.",
+ "training": "https://learn.microsoft.com/training/modules/azure-event-grid/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Storage",
+ "services": [
+ "Storage"
+ ],
+ "severity": "High",
+ "subcategory": "Overview",
+ "text": "Enable secure transfer to storage accounts.",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
+ "service": "Storage",
+ "services": [
+ "Storage"
+ ],
+ "severity": "High",
+ "subcategory": "Overview",
+ "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6f704104-85c1-441f-96d3-c9819911645e",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning",
+ "services": [
+ "Entra"
+ ],
+ "severity": "High",
+ "subcategory": "Secure privileged access",
+ "text": "Separate privileged admin accounts for Azure administrative tasks.",
+ "training": "https://learn.microsoft.com/training/modules/design-solutions-secure-privileged-access/",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "9a19bf39-c95d-444c-9c89-19ca1f6d5215",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Service enablement framework",
+ "text": "Plan how new azure services will be implemented.",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ae514b93-3d45-485e-8112-9bd7ba012f7b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Service enablement framework",
+ "text": "Plan how service request will be fulfilled for Azure services.",
+ "waf": "Security"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e85f4226-bf06-4e35-8a8b-7aee4d2d633a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/platform-automation-devops",
+ "services": [],
+ "severity": "High",
+ "subcategory": "DevOps Team Topologies",
+ "text": "Ensure you have a cross functional DevOps Platform Team to build, manage and maintain your Azure Landing Zone architecture.",
+ "training": "https://learn.microsoft.com/training/modules/choose-an-agile-approach/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "634146bf-7085-4419-a7b5-f96d2726f6da",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/devops-teams-topologies#design-recommendations",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "DevOps Team Topologies",
+ "text": "Aim to define functions for Azure Landing Zone Platform team.",
+ "training": "https://learn.microsoft.com/training/paths/az-400-work-git-for-enterprise-devops/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a9e65070-c59e-4112-8bf6-c11364d4a2a5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/devops-teams-topologies#design-recommendations",
+ "services": [
+ "RBAC"
+ ],
+ "severity": "Low",
+ "subcategory": "DevOps Team Topologies",
+ "text": "Aim to define functions for application workload teams to be self-sufficient and not require DevOps Platform Team support. Achieve this through the use of custom RBAC role.",
+ "training": "https://learn.microsoft.com/training/paths/az-400-work-git-for-enterprise-devops/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "165eb5e9-b434-448a-9e24-178632186212",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/infrastructure-as-code",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "DevOps Team Topologies",
+ "text": "Use a CI/CD pipeline to deploy IaC artifacts and ensure the quality of your deployment and Azure environments.",
+ "training": "https://learn.microsoft.com/training/modules/manage-multiple-environments-using-bicep-azure-pipelines/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "0cadb8c7-8fa5-4fbf-8f39-d1fadb3b0460",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "DevOps Team Topologies",
+ "text": "Include unit tests for IaC and application code as part of your build process.",
+ "training": "https://learn.microsoft.com/training/modules/run-quality-tests-build-pipeline/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
+ "service": "Key Vault",
+ "services": [
+ "VM",
+ "AKV"
+ ],
+ "severity": "High",
+ "subcategory": "DevOps Team Topologies",
+ "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a52e0c98-76b9-4a09-a1c9-6b2babf22ac4",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/subscription-vending",
+ "services": [
+ "Subscriptions"
+ ],
+ "severity": "Low",
+ "subcategory": "DevOps Team Topologies",
+ "text": "Implement automation for new landing zone for applications and workloads through subscription vending.",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cfe363b5-f579-4284-bc56-a42153e4c10b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/infrastructure-as-code",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Development Lifecycle",
+ "text": "Ensure a version control system is used for source code of applications and IaC developed. Microsoft recommends Git.",
+ "training": "https://learn.microsoft.com/training/paths/intro-to-vc-git/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c7245dd4-af8a-403a-8bb7-890c1a7cfa9d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle",
+ "services": [],
+ "severity": "Low",
+ "subcategory": "Development Lifecycle",
+ "text": "Follow a branching strategy to allow teams to collaborate better and efficiently manage version control of IaC and application Code. Review options such as Github Flow.",
+ "training": "https://learn.microsoft.com/training/modules/manage-git-branches-workflows/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "12aeea20-9165-4b3e-bdf2-6795fcd3cdbe",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Development Lifecycle",
+ "text": "Adopt a pull request strategy to help keep control of code changes merged into branches.",
+ "training": "https://learn.microsoft.com/training/modules/review-azure-infrastructure-changes-using-bicep-pull-requests/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2676ae46-65ca-444e-8695-fdddeace4cb1",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-platform",
+ "services": [],
+ "severity": "Medium",
+ "subcategory": "Development Lifecycle",
+ "text": "Establish a process for using code to implement quick fixes. Always register quick fixes in your team's backlog so each fix can be reworked at a later point, and you can limit technical debt.",
+ "training": "https://learn.microsoft.com/training/modules/branch-merge-git/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2cdc9d99-dbcc-4ad4-97f5-e7d358bdfa73",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/infrastructure-as-code",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Development Strategy",
+ "text": "Leverage Declarative Infrastructure as Code Tools such as Azure Bicep, ARM Templates or Terraform to build and maintain your Azure Landing Zone architecture. Both from a Platform and Application workload perspective.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-infrastructure-as-code-using-bicep/",
+ "waf": "Operations"
+ },
+ {
+ "category": "Platform Automation and DevOps",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cc87a3bc-c572-4ad2-92ed-8cabab66160f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/landing-zone-security#secure",
+ "services": [],
+ "severity": "High",
+ "subcategory": "Security",
+ "text": "Integrate security into the already combined process of development and operations in DevOps to mitigate risks in the innovation process.",
+ "training": "https://learn.microsoft.com/training/paths/az-400-implement-security-validate-code-bases-compliance/",
+ "waf": "Operations"
+ },
{
"category": "Governance",
"checklist": "Azure API Management Review",
@@ -37,9 +3571,9 @@
"link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
"service": "APIM",
"services": [
+ "ACR",
"APIM",
- "AzurePolicy",
- "ACR"
+ "AzurePolicy"
],
"severity": "Medium",
"subcategory": "Development best practices",
@@ -67,8 +3601,8 @@
"link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
"service": "APIM",
"services": [
- "APIM",
- "Monitor"
+ "Monitor",
+ "APIM"
],
"severity": "High",
"subcategory": "Monitoring",
@@ -82,8 +3616,8 @@
"link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
"service": "APIM",
"services": [
- "APIM",
- "Monitor"
+ "Monitor",
+ "APIM"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -97,8 +3631,8 @@
"link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
"service": "APIM",
"services": [
- "APIM",
- "Monitor"
+ "Monitor",
+ "APIM"
],
"severity": "High",
"subcategory": "Monitoring",
@@ -113,8 +3647,8 @@
"service": "APIM",
"services": [
"Entra",
- "AKV",
- "APIM"
+ "APIM",
+ "AKV"
],
"severity": "High",
"subcategory": "Data protection",
@@ -202,9 +3736,9 @@
"link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
"service": "APIM",
"services": [
+ "ACR",
"ASR",
- "APIM",
- "ACR"
+ "APIM"
],
"severity": "Medium",
"subcategory": "Business continuity and disaster recovery",
@@ -233,9 +3767,9 @@
"link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
"service": "APIM",
"services": [
- "Backup",
+ "ASR",
"APIM",
- "ASR"
+ "Backup"
],
"severity": "High",
"subcategory": "Business continuity and disaster recovery",
@@ -428,9 +3962,9 @@
"service": "APIM",
"services": [
"Entra",
- "APIM",
"VNet",
- "Monitor"
+ "Monitor",
+ "APIM"
],
"severity": "Medium",
"subcategory": "Security",
@@ -445,9 +3979,9 @@
"service": "APIM",
"services": [
"Entra",
+ "VNet",
"APIM",
- "PrivateLink",
- "VNet"
+ "PrivateLink"
],
"severity": "Medium",
"subcategory": "Security",
@@ -603,8 +4137,8 @@
"link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
"service": "APIM",
"services": [
- "AKV",
- "APIM"
+ "APIM",
+ "AKV"
],
"severity": "High",
"subcategory": "Data protection",
@@ -634,8 +4168,8 @@
"service": "APIM",
"services": [
"Entra",
- "APIM",
"AppGW",
+ "APIM",
"WAF"
],
"severity": "High",
@@ -662,8 +4196,8 @@
"link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
"service": "Spring Apps",
"services": [
- "TrafficManager",
"ASR",
+ "TrafficManager",
"FrontDoor"
],
"severity": "Medium",
@@ -754,8 +4288,8 @@
"service": "AVS",
"services": [
"Entra",
- "AVS",
- "Subscriptions"
+ "Subscriptions",
+ "AVS"
],
"severity": "High",
"subcategory": "Identity",
@@ -912,11 +4446,11 @@
"guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
"service": "AVS",
"services": [
+ "Monitor",
"NetworkWatcher",
+ "ExpressRoute",
"AVS",
- "VPN",
- "Monitor",
- "ExpressRoute"
+ "VPN"
],
"severity": "High",
"subcategory": "Monitoring",
@@ -929,11 +4463,11 @@
"guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
"service": "AVS",
"services": [
- "NetworkWatcher",
- "AVS",
- "VM",
"Monitor",
- "ExpressRoute"
+ "VM",
+ "NetworkWatcher",
+ "ExpressRoute",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -946,10 +4480,10 @@
"guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
"service": "AVS",
"services": [
- "Monitor",
- "AVS",
"VM",
- "NetworkWatcher"
+ "Monitor",
+ "NetworkWatcher",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -1063,9 +4597,9 @@
"guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
"service": "AVS",
"services": [
- "Entra",
+ "VM",
"AVS",
- "VM"
+ "Entra"
],
"severity": "High",
"subcategory": "Security (identity)",
@@ -1091,8 +4625,8 @@
"guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
"service": "AVS",
"services": [
- "AVS",
"AppGW",
+ "AVS",
"Firewall"
],
"severity": "High",
@@ -1119,8 +4653,8 @@
"guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
"service": "AVS",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Security (network)",
@@ -1133,11 +4667,11 @@
"guid": "334fdf91-c234-4182-a652-75269440b4be",
"service": "AVS",
"services": [
+ "VNet",
"DDoS",
- "AVS",
- "VPN",
"ExpressRoute",
- "VNet"
+ "AVS",
+ "VPN"
],
"severity": "Medium",
"subcategory": "Security (network)",
@@ -1163,8 +4697,8 @@
"guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
"service": "AVS",
"services": [
- "AVS",
- "Defender"
+ "Defender",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Security (guest/VM)",
@@ -1177,8 +4711,8 @@
"guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
"service": "AVS",
"services": [
- "AVS",
- "Arc"
+ "Arc",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Security (guest/VM)",
@@ -1191,8 +4725,8 @@
"guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
"service": "AVS",
"services": [
- "AVS",
- "SQL"
+ "SQL",
+ "AVS"
],
"severity": "Low",
"subcategory": "Security (guest/VM)",
@@ -1205,8 +4739,8 @@
"guid": "a3592718-e6e2-4051-9267-6ae46691e883",
"service": "AVS",
"services": [
- "AKV",
- "AVS"
+ "AVS",
+ "AKV"
],
"severity": "Low",
"subcategory": "Security (guest/VM)",
@@ -1245,9 +4779,9 @@
"guid": "d88408f3-7273-44c8-96ba-280214590146",
"service": "AVS",
"services": [
- "AVS",
+ "Storage",
"AzurePolicy",
- "Storage"
+ "AVS"
],
"severity": "High",
"subcategory": "Governance (platform)",
@@ -1260,8 +4794,8 @@
"guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
"service": "AVS",
"services": [
- "AVS",
- "ASR"
+ "ASR",
+ "AVS"
],
"severity": "High",
"subcategory": "Governance (platform)",
@@ -1287,8 +4821,8 @@
"guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
"service": "AVS",
"services": [
- "AVS",
- "AzurePolicy"
+ "AzurePolicy",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Governance (platform)",
@@ -1301,8 +4835,8 @@
"guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
"service": "AVS",
"services": [
- "AVS",
- "Cost"
+ "Cost",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Governance (platform)",
@@ -1315,8 +4849,8 @@
"guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
"service": "AVS",
"services": [
- "AVS",
- "Cost"
+ "Cost",
+ "AVS"
],
"severity": "Low",
"subcategory": "Governance (platform)",
@@ -1355,9 +4889,9 @@
"guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
"service": "AVS",
"services": [
- "AVS",
"VM",
- "Defender"
+ "Defender",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Governance (guest/VM)",
@@ -1370,9 +4904,9 @@
"guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
"service": "AVS",
"services": [
- "AVS",
"VM",
- "Arc"
+ "Arc",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Governance (guest/VM)",
@@ -1398,9 +4932,9 @@
"guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
"service": "AVS",
"services": [
- "AVS",
"VM",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Governance (guest/VM)",
@@ -1414,9 +4948,9 @@
"service": "AVS",
"services": [
"VM",
+ "AzurePolicy",
"AVS",
- "Backup",
- "AzurePolicy"
+ "Backup"
],
"severity": "Medium",
"subcategory": "Governance (guest/VM)",
@@ -1429,9 +4963,9 @@
"guid": "ee29711b-d352-4caa-ab79-b198dab81932",
"service": "AVS",
"services": [
- "AVS",
"Defender",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Compliance",
@@ -1444,8 +4978,8 @@
"guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
"service": "AVS",
"services": [
- "AVS",
- "Defender"
+ "Defender",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Compliance",
@@ -1497,8 +5031,8 @@
"guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
"service": "AVS",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "High",
"subcategory": "Monitoring",
@@ -1511,8 +5045,8 @@
"guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
"service": "AVS",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "High",
"subcategory": "Monitoring",
@@ -1525,8 +5059,8 @@
"guid": "9659e396-80e7-4828-ac93-5657d02bff45",
"service": "AVS",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "High",
"subcategory": "Monitoring",
@@ -1539,8 +5073,8 @@
"guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
"service": "AVS",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "High",
"subcategory": "Monitoring",
@@ -1554,8 +5088,8 @@
"service": "AVS",
"services": [
"Monitor",
- "AVS",
- "Storage"
+ "Storage",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -1568,8 +5102,8 @@
"guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
"service": "AVS",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Low",
"subcategory": "Monitoring",
@@ -1582,10 +5116,10 @@
"guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
"service": "AVS",
"services": [
- "AVS",
"VM",
+ "Storage",
"AzurePolicy",
- "Storage"
+ "AVS"
],
"severity": "High",
"subcategory": "Operations",
@@ -1611,9 +5145,9 @@
"guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
"service": "AVS",
"services": [
+ "Storage",
"AVS",
- "Backup",
- "Storage"
+ "Backup"
],
"severity": "Medium",
"subcategory": "Operations",
@@ -1626,8 +5160,8 @@
"guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
"service": "AVS",
"services": [
- "AVS",
- "Arc"
+ "Arc",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Operations",
@@ -1640,8 +5174,8 @@
"guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
"service": "AVS",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Operations",
@@ -1667,9 +5201,9 @@
"guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
"service": "AVS",
"services": [
- "AVS",
+ "Monitor",
"AzurePolicy",
- "Monitor"
+ "AVS"
],
"severity": "Medium",
"subcategory": "Operations",
@@ -1682,8 +5216,8 @@
"guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
"service": "AVS",
"services": [
- "AVS",
- "Defender"
+ "Defender",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Security",
@@ -1710,8 +5244,8 @@
"guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
"service": "AVS",
"services": [
- "AVS",
- "ASR"
+ "ASR",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Disaster Recovery",
@@ -1724,8 +5258,8 @@
"guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
"service": "AVS",
"services": [
- "AVS",
- "ASR"
+ "ASR",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Disaster Recovery",
@@ -1738,8 +5272,8 @@
"guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
"service": "AVS",
"services": [
- "AVS",
- "ASR"
+ "ASR",
+ "AVS"
],
"severity": "High",
"subcategory": "Disaster Recovery",
@@ -1752,8 +5286,8 @@
"guid": "8255461e-2aee-4345-9aec-8339248b262d",
"service": "AVS",
"services": [
- "AVS",
- "ASR"
+ "ASR",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Disaster Recovery",
@@ -1766,8 +5300,8 @@
"guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
"service": "AVS",
"services": [
- "AVS",
- "ASR"
+ "ASR",
+ "AVS"
],
"severity": "High",
"subcategory": "Disaster Recovery",
@@ -1780,9 +5314,9 @@
"guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
"service": "AVS",
"services": [
- "AVS",
"ASR",
"NVA",
+ "AVS",
"ExpressRoute"
],
"severity": "Medium",
@@ -1903,8 +5437,8 @@
"guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
"service": "AVS",
"services": [
- "AVS",
- "AzurePolicy"
+ "AzurePolicy",
+ "AVS"
],
"severity": "Low",
"subcategory": "Automated Deployment",
@@ -1917,8 +5451,8 @@
"guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
"service": "AVS",
"services": [
- "AKV",
- "AVS"
+ "AVS",
+ "AKV"
],
"severity": "Low",
"subcategory": "Automated Connectivity",
@@ -1931,9 +5465,9 @@
"guid": "255461e2-aee3-4553-afc8-339248b262d6",
"service": "AVS",
"services": [
- "AKV",
"AVS",
- "ExpressRoute"
+ "ExpressRoute",
+ "AKV"
],
"severity": "Low",
"subcategory": "Automated Connectivity",
@@ -1972,8 +5506,8 @@
"guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
"service": "AVS",
"services": [
- "AVS",
- "Subscriptions"
+ "Subscriptions",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Automated Scale",
@@ -1986,9 +5520,9 @@
"guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
"service": "AVS",
"services": [
- "AVS",
+ "Storage",
"AzurePolicy",
- "Storage"
+ "AVS"
],
"severity": "Medium",
"subcategory": "Automated Scale",
@@ -2040,8 +5574,8 @@
"guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
"service": "AVS",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Automated Scale",
@@ -2055,8 +5589,8 @@
"link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
"service": "AVS",
"services": [
- "AVS",
- "VM"
+ "VM",
+ "AVS"
],
"severity": "High",
"subcategory": "Architecture",
@@ -2085,8 +5619,8 @@
"guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
"service": "AVS",
"services": [
- "VPN",
- "AVS"
+ "AVS",
+ "VPN"
],
"severity": "Medium",
"subcategory": "Networking",
@@ -2126,9 +5660,9 @@
"link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
"service": "AVS",
"services": [
- "AVS",
"VM",
- "Storage"
+ "Storage",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Architecture",
@@ -2142,9 +5676,9 @@
"link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
"service": "AVS",
"services": [
+ "Storage",
"AVS",
- "ExpressRoute",
- "Storage"
+ "ExpressRoute"
],
"severity": "Medium",
"subcategory": "Architecture",
@@ -2158,9 +5692,9 @@
"link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
"service": "AVS",
"services": [
+ "Storage",
"AVS",
- "ExpressRoute",
- "Storage"
+ "ExpressRoute"
],
"severity": "Medium",
"subcategory": "Architecture",
@@ -2174,8 +5708,8 @@
"link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
"service": "AVS",
"services": [
- "AVS",
- "ASR"
+ "ASR",
+ "AVS"
],
"severity": "High",
"subcategory": "Architecture",
@@ -2263,8 +5797,8 @@
"link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy",
"service": "ACR",
"services": [
- "AzurePolicy",
- "ACR"
+ "ACR",
+ "AzurePolicy"
],
"severity": "High",
"subcategory": "Data Protection",
@@ -2279,8 +5813,8 @@
"link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push",
"service": "ACR",
"services": [
- "AKV",
- "ACR"
+ "ACR",
+ "AKV"
],
"severity": "High",
"subcategory": "Data Protection",
@@ -2295,8 +5829,8 @@
"link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys",
"service": "ACR",
"services": [
- "AKV",
- "ACR"
+ "ACR",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Data Protection",
@@ -2395,8 +5929,8 @@
"services": [
"Entra",
"EventHubs",
- "PrivateLink",
- "ACR"
+ "ACR",
+ "PrivateLink"
],
"severity": "High",
"subcategory": "Identity and Access Control",
@@ -2412,8 +5946,8 @@
"service": "ACR",
"services": [
"Entra",
- "AzurePolicy",
- "ACR"
+ "ACR",
+ "AzurePolicy"
],
"severity": "Medium",
"subcategory": "Identity and Access Control",
@@ -2428,9 +5962,9 @@
"link": "https://learn.microsoft.com/azure/container-registry/monitor-service",
"service": "ACR",
"services": [
- "Entra",
"Monitor",
- "ACR"
+ "ACR",
+ "Entra"
],
"severity": "Medium",
"subcategory": "Logging and Monitoring",
@@ -2445,10 +5979,10 @@
"link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
"service": "ACR",
"services": [
- "PrivateLink",
"VNet",
+ "ACR",
"Firewall",
- "ACR"
+ "PrivateLink"
],
"severity": "Medium",
"subcategory": "Network Security",
@@ -2463,8 +5997,8 @@
"link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access",
"service": "ACR",
"services": [
- "PrivateLink",
- "ACR"
+ "ACR",
+ "PrivateLink"
],
"severity": "Medium",
"subcategory": "Network Security",
@@ -2479,8 +6013,8 @@
"link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus",
"service": "ACR",
"services": [
- "PrivateLink",
- "ACR"
+ "ACR",
+ "PrivateLink"
],
"severity": "Medium",
"subcategory": "Network Security",
@@ -2538,9 +6072,9 @@
"guid": "976f32a7-30d1-6caa-c2a0-207fdc26571b",
"link": "https://learn.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution",
"services": [
+ "Storage",
"AVS",
- "Backup",
- "Storage"
+ "Backup"
],
"severity": "Medium",
"subcategory": "Backup",
@@ -2569,9 +6103,9 @@
"guid": "be28860f-3d29-a79a-1a0e-36f1b23b36ae",
"link": "Best practice to deploy backup in the same region as your AVS deployment",
"services": [
+ "ASR",
"AVS",
- "Backup",
- "ASR"
+ "Backup"
],
"severity": "Medium",
"subcategory": "Business Continuity",
@@ -2613,8 +6147,8 @@
"guid": "f379436d-3051-daa0-01fb-dc4e0e04d677",
"link": "https://docs.microsoft.com/azure/azure-vmware/disaster-recovery-using-vmware-site-recovery-manager",
"services": [
- "AVS",
- "ASR"
+ "ASR",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Disaster Recovery",
@@ -2628,8 +6162,8 @@
"guid": "367f71d8-3cf6-51a0-91a5-3db3d570cc19",
"link": "https://docs.microsoft.com/azure/site-recovery/avs-tutorial-prepare-azure",
"services": [
- "AVS",
- "ASR"
+ "ASR",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Disaster Recovery",
@@ -2643,8 +6177,8 @@
"guid": "ee02ada0-1887-bb3a-b84c-423f45a09ef9",
"link": "https://docs.microsoft.com/azure/site-recovery/avs-tutorial-prepare-azure",
"services": [
- "AVS",
- "ASR"
+ "ASR",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Disaster Recovery",
@@ -2658,8 +6192,8 @@
"guid": "0c2b74e5-9c28-780d-1df3-12d3de4aaa76",
"link": "https://docs.microsoft.com/azure/azure-vmware/connect-multiple-private-clouds-same-region",
"services": [
- "AVS",
- "ASR"
+ "ASR",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Disaster Recovery",
@@ -2673,8 +6207,8 @@
"guid": "c2a34ec4-2933-4e6c-dc36-e20e67abbe3f",
"link": "https://docs.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
"services": [
- "AVS",
- "ASR"
+ "ASR",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Disaster Recovery",
@@ -2688,9 +6222,9 @@
"guid": "b44fb6ec-bfc1-3a8e-dba2-ca97f0991d2c",
"link": "This depends if you have multiple AVS Private Clouds. If so and they are in the same region then use AVS Interconnect. If they are in separate regions then use ExpressRoute Global Reach.",
"services": [
- "AVS",
"ASR",
"NVA",
+ "AVS",
"ExpressRoute"
],
"severity": "Medium",
@@ -2780,8 +6314,8 @@
"guid": "91f7a87b-21ac-d712-959c-8df2ba034253",
"link": "https://learn.microsoft.com/azure/virtual-network/quick-create-portal",
"services": [
- "AVS",
- "VNet"
+ "VNet",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Hub & Spoke",
@@ -2795,10 +6329,10 @@
"guid": "58a027e2-f37f-b540-45d5-e44843aba26b",
"link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings",
"services": [
- "VPN",
- "AVS",
+ "ExpressRoute",
"VNet",
- "ExpressRoute"
+ "AVS",
+ "VPN"
],
"severity": "Medium",
"subcategory": "Hub & Spoke",
@@ -2812,10 +6346,10 @@
"guid": "d4806549-0913-3e79-b580-ac2d3706e65a",
"link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings",
"services": [
- "VPN",
- "AVS",
+ "ExpressRoute",
"VNet",
- "ExpressRoute"
+ "AVS",
+ "VPN"
],
"severity": "Medium",
"subcategory": "Hub & Spoke",
@@ -2829,10 +6363,10 @@
"guid": "864d7a8b-7016-c769-a717-61af6bfb73d2",
"link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings",
"services": [
- "VPN",
- "AVS",
+ "ExpressRoute",
"VNet",
- "ExpressRoute"
+ "AVS",
+ "VPN"
],
"severity": "Medium",
"subcategory": "Hub & Spoke",
@@ -2846,8 +6380,8 @@
"guid": "cc2e11b9-7911-7da1-458c-d7fcef794aad",
"link": "https://learn.microsoft.com/azure/azure-vmware/enable-public-internet-access",
"services": [
- "AVS",
- "NVA"
+ "NVA",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Internet",
@@ -2877,8 +6411,8 @@
"link": "https://learn.microsoft.com/azure/bastion/tutorial-create-host-portal",
"services": [
"Bastion",
- "AVS",
- "VNet"
+ "VNet",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Jumpbox & Bastion",
@@ -2893,8 +6427,8 @@
"link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview",
"services": [
"Bastion",
- "AVS",
- "VM"
+ "VM",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Jumpbox & Bastion",
@@ -2908,8 +6442,8 @@
"guid": "9988598f-2a9f-6b12-9b46-488415ceb325",
"link": "https://learn.microsoft.com/azure/azure-vmware/configure-site-to-site-vpn-gateway",
"services": [
- "VPN",
- "AVS"
+ "AVS",
+ "VPN"
],
"severity": "Medium",
"subcategory": "VPN",
@@ -2923,8 +6457,8 @@
"guid": "956ce5e9-a862-fe2b-a50d-a22923569357",
"link": "https://www.omnicalculator.com/other/data-transfer#:~:text=To%20calculate%20the%20data%20transfer%20speed%3A%201%20Download,measured%20time%20to%20find%20the%20data%20transfer%20speed.",
"services": [
- "VPN",
- "AVS"
+ "AVS",
+ "VPN"
],
"severity": "Medium",
"subcategory": "VPN",
@@ -2938,8 +6472,8 @@
"guid": "e095116f-0bdc-4b51-4d71-b9e469d56f59",
"link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/azure-vmware-solution-foundation-networking",
"services": [
- "VPN",
- "AVS"
+ "AVS",
+ "VPN"
],
"severity": "Medium",
"subcategory": "VPN",
@@ -2968,9 +6502,9 @@
"guid": "51d6affd-8e02-6aea-d3d4-0baf618b3076",
"link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-point-to-site-portal",
"services": [
- "VPN",
+ "VWAN",
"AVS",
- "VWAN"
+ "VPN"
],
"severity": "Medium",
"subcategory": "vWAN hub",
@@ -2984,8 +6518,8 @@
"guid": "e32a4c67-3dc0-c134-1c12-52d46dcbab5b",
"link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-expressroute-portal",
"services": [
- "AVS",
"Firewall",
+ "AVS",
"VWAN"
],
"severity": "Medium",
@@ -3156,8 +6690,8 @@
"link": "Best practice",
"services": [
"Entra",
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Security ",
@@ -3186,9 +6720,9 @@
"guid": "8f426fd0-d73b-d398-1f6f-df0cbe262a82",
"link": "https://learn.microsoft.com/azure/azure-arc/vmware-vsphere/overview",
"services": [
- "AVS",
"VM",
- "Arc"
+ "Arc",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Operations",
@@ -3202,9 +6736,9 @@
"guid": "11dbe773-e380-9191-1418-e886fa7a6fd0",
"link": "https://docs.microsoft.com/azure/governance/policy/overview",
"services": [
- "AVS",
+ "Monitor",
"AzurePolicy",
- "Monitor"
+ "AVS"
],
"severity": "Medium",
"subcategory": "Operations",
@@ -3246,8 +6780,8 @@
"guid": "86b314f9-1f1e-317a-4dfb-cf510ad4a030",
"link": "https://docs.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
"services": [
- "AKV",
- "AVS"
+ "AVS",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Operations",
@@ -3261,8 +6795,8 @@
"guid": "e22a2d99-eb71-7d7c-07af-6d4cdb1d4443",
"link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Alerts",
@@ -3276,8 +6810,8 @@
"guid": "6d02f159-627d-79bf-a931-fab6d947eda2",
"link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Alerts",
@@ -3291,8 +6825,8 @@
"guid": "1cc97b39-2c7e-246f-6d73-789cfebfe951",
"link": "https://www.virtualworkloads.com/2021/04/azure-vmware-solution-azure-service-health/",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Alerts",
@@ -3306,11 +6840,11 @@
"guid": "0962606c-e3b4-62a9-5661-e4ffd62a4509",
"link": "https://docs.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution",
"services": [
- "Backup",
- "AVS",
- "VM",
+ "Monitor",
"AzurePolicy",
- "Monitor"
+ "VM",
+ "Backup",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Backup",
@@ -3324,9 +6858,9 @@
"guid": "4ec7ccfb-795e-897e-4a84-fd31c04eadc6",
"link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution",
"services": [
- "AVS",
+ "Monitor",
"AzurePolicy",
- "Monitor"
+ "AVS"
],
"severity": "Medium",
"subcategory": "Capacity",
@@ -3340,10 +6874,10 @@
"guid": "7f8f175d-13f4-5298-9e61-0bc7e9fcc279",
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/govern",
"services": [
- "AVS",
+ "Monitor",
"Cost",
- "Subscriptions",
- "Monitor"
+ "AVS",
+ "Subscriptions"
],
"severity": "Medium",
"subcategory": "Costs",
@@ -3358,8 +6892,8 @@
"link": "https://docs.microsoft.com/azure/azure-portal/azure-portal-dashboards",
"services": [
"Monitor",
- "AVS",
- "NetworkWatcher"
+ "NetworkWatcher",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Dashboard",
@@ -3373,9 +6907,9 @@
"guid": "f9afdcc9-649d-d840-9fb5-a3c0edcc697d",
"link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs",
"services": [
- "AVS",
+ "Monitor",
"Storage",
- "Monitor"
+ "AVS"
],
"severity": "Medium",
"subcategory": "Logs & Metrics",
@@ -3389,8 +6923,8 @@
"guid": "7cbac8c3-4eda-d5d9-9bda-c6b5abba9fb6",
"link": "Is vROPS or vRealize Network Insight going to be used? ",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Logs & Metrics",
@@ -3404,9 +6938,9 @@
"guid": "b243521a-644d-f865-7fb6-21f9019c0dd2",
"link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs",
"services": [
- "AVS",
"VM",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Logs & Metrics",
@@ -3420,11 +6954,11 @@
"guid": "2ca97d91-dd36-7229-b668-01036ccc3cd3",
"link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal",
"services": [
+ "Monitor",
"NetworkWatcher",
+ "ExpressRoute",
"AVS",
- "VPN",
- "Monitor",
- "ExpressRoute"
+ "VPN"
],
"severity": "Medium",
"subcategory": "Network",
@@ -3438,9 +6972,9 @@
"guid": "99209143-60fe-19f0-5633-8b5671277ba5",
"link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal",
"services": [
+ "Monitor",
"AVS",
- "ExpressRoute",
- "Monitor"
+ "ExpressRoute"
],
"severity": "Medium",
"subcategory": "Network",
@@ -3454,8 +6988,8 @@
"guid": "b9e5867c-57d3-036f-fb1b-3f0a71664efe",
"link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Network",
@@ -3469,8 +7003,8 @@
"guid": "4af7c5f7-e5e9-bedf-a8cf-314b81735962",
"link": "Firewall logging and alerting rules are configured (Azure Firewall or 3rd party)",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Security",
@@ -3484,8 +7018,8 @@
"guid": "74be60a3-cfac-f057-eda6-3ee087e805d5",
"link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Security",
@@ -3499,8 +7033,8 @@
"guid": "a434b3b5-f258-0845-cd76-d7df6ef5890e",
"link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "VMWare",
@@ -3514,9 +7048,9 @@
"guid": "fb00b69a-83ec-ce72-446e-6c23a0cab09a",
"link": "https://docs.microsoft.com/azure/azure-monitor/agents/agent-windows?tabs=setup-wizard",
"services": [
- "AVS",
"VM",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "VMware",
@@ -3558,9 +7092,9 @@
"guid": "ebd3cc3c-ac3d-4293-950d-cecd8445a523",
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity",
"services": [
+ "NVA",
"ARS",
- "AVS",
- "NVA"
+ "AVS"
],
"severity": "Medium",
"subcategory": "Hub & Spoke",
@@ -3603,10 +7137,10 @@
"guid": "e942c03d-beaa-3d9f-0526-9b26cd5e9937",
"link": "Research and choose optimal solution for each application",
"services": [
- "AVS",
+ "FrontDoor",
"AppGW",
- "NVA",
- "FrontDoor"
+ "AVS",
+ "NVA"
],
"severity": "Medium",
"subcategory": "Internet",
@@ -3636,14 +7170,14 @@
"link": "https://docs.microsoft.com/azure/ddos-protection/manage-ddos-protection",
"services": [
"AppGW",
+ "VNet",
"DDoS",
- "AVS",
"VM",
- "VPN",
- "LoadBalancer",
"FrontDoor",
"ExpressRoute",
- "VNet"
+ "VPN",
+ "AVS",
+ "LoadBalancer"
],
"severity": "Medium",
"subcategory": "Security",
@@ -3685,9 +7219,9 @@
"guid": "3f621543-dfac-c471-54a6-7b2849b6909a",
"link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
"services": [
+ "VWAN",
"AVS",
- "Firewall",
- "VWAN"
+ "Firewall"
],
"severity": "Medium",
"subcategory": "Virtual WAN",
@@ -3716,8 +7250,8 @@
"guid": "7d049005-eb35-4a93-50a5-3b31a9f61161",
"link": "https://docs.microsoft.com/azure/azure-vmware/configure-nsx-network-components-azure-portal",
"services": [
- "AVS",
- "Subscriptions"
+ "Subscriptions",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Automated Scale",
@@ -3731,9 +7265,9 @@
"guid": "7242c1de-da37-27f3-1ddd-565ccccb8ece",
"link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-platform-automation-and-devops#automated-scale",
"services": [
- "AVS",
+ "Storage",
"AzurePolicy",
- "Storage"
+ "AVS"
],
"severity": "Medium",
"subcategory": "Automated Scale",
@@ -3789,8 +7323,8 @@
"guid": "7bd65a5e-7b5d-652d-dbea-fc6f73a42857",
"link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-management-and-monitoring",
"services": [
- "AVS",
- "Monitor"
+ "Monitor",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Automated Scale",
@@ -3804,8 +7338,8 @@
"guid": "95e374af-8a2a-2672-7ab7-b4a1be43ada7",
"link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
"services": [
- "PrivateLink",
- "AVS"
+ "AVS",
+ "PrivateLink"
],
"severity": "Medium",
"subcategory": "Networking",
@@ -3847,8 +7381,8 @@
"guid": "e52d1615-9cc6-565c-deb6-743ed7e90f4b",
"link": "Internal policy or regulatory compliance",
"services": [
- "AVS",
- "AzurePolicy"
+ "AzurePolicy",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Pre-deployment",
@@ -3890,8 +7424,8 @@
"guid": "96c76997-30a6-bb92-024d-f4f93f5f57fa",
"link": "Done through the subscription/resource providers/ AVS register in the portal",
"services": [
- "AVS",
- "Subscriptions"
+ "Subscriptions",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Pre-deployment",
@@ -3905,8 +7439,8 @@
"guid": "5898e3ff-5e6b-bee1-6f85-22fee261ce63",
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/enterprise-scale-landing-zone",
"services": [
- "AVS",
- "Subscriptions"
+ "Subscriptions",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Pre-deployment",
@@ -3962,8 +7496,8 @@
"guid": "0c87f999-e517-21ef-f355-f210ad4134d2",
"link": "https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/installation/GUID-4B3860B8-1883-48CA-B2F3-7C2205D91D6D.html",
"services": [
- "AVS",
- "VNet"
+ "VNet",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Pre-deployment",
@@ -4005,8 +7539,8 @@
"guid": "f2b73c4f-3d46-32c9-5df1-5b8dfcd3947f",
"link": "https://azure.microsoft.com/en-ca/pricing/details/azure-vmware/#:~:text=Azure%20VMware%20Solution%20%20%20%20Instance%20size,TB%20%28all%20NVMe%29%20%20%20N%2FA%20%2Fhour%20",
"services": [
- "AVS",
- "Cost"
+ "Cost",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Pre-deployment",
@@ -4020,8 +7554,8 @@
"guid": "94ac48ab-ade5-3fa7-f800-263feeb97070",
"link": "https://docs.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance",
"services": [
- "AVS",
- "ASR"
+ "ASR",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Pre-deployment",
@@ -4063,8 +7597,8 @@
"guid": "70cfbddc-d3d4-9188-77c8-1cabaefef646",
"link": "General recommendation for storing encryption keys.",
"services": [
- "AKV",
- "AVS"
+ "AVS",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Encryption",
@@ -4078,8 +7612,8 @@
"guid": "c1a81638-18df-0ce9-a73a-4b9a8a8dd392",
"link": "https://docs.microsoft.com/azure/azure-vmware/concepts-storage#data-at-rest-encryption",
"services": [
- "AVS",
- "SQL"
+ "SQL",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Encryption",
@@ -4093,9 +7627,9 @@
"guid": "8d0a8f51-8d35-19cd-c2fe-4e3512fb467e",
"link": "https://docs.microsoft.com/azure/key-vault/general/authentication",
"services": [
- "AKV",
"AVS",
- "ExpressRoute"
+ "ExpressRoute",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Encryption",
@@ -4138,8 +7672,8 @@
"guid": "f42b0b09-c591-238a-1580-2de3c485ebd2",
"link": "https://learn.microsoft.com/azure/azure-vmware/azure-security-integration#prerequisites",
"services": [
- "AVS",
- "Defender"
+ "Defender",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Security",
@@ -4153,8 +7687,8 @@
"guid": "bcdd2348-3d0e-c6bb-1092-aa4cd1a66d6b",
"link": "https://docs.microsoft.com/azure/azure-vmware/azure-security-integration",
"services": [
- "AVS",
- "AzurePolicy"
+ "AzurePolicy",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Security",
@@ -4308,8 +7842,8 @@
"guid": "16ab821a-27c6-b6d3-6042-10dc4d6dfcb7",
"link": "https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.storage.doc/GUID-01D3CF47-A84A-4988-8103-A0487D6441AA.html",
"services": [
- "AVS",
- "Storage"
+ "Storage",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Storage",
@@ -4323,9 +7857,9 @@
"guid": "eb2f9313-afb2-ab35-aa24-6d97a3cb0611",
"link": "3rd-Party tools",
"services": [
- "AVS",
"VM",
- "Storage"
+ "Storage",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Storage",
@@ -4339,9 +7873,9 @@
"guid": "3f2a5cff-c8a6-634a-1f1b-53ef9d321381",
"link": "Contact VMware",
"services": [
- "AVS",
"VM",
- "Storage"
+ "Storage",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Storage",
@@ -4355,8 +7889,8 @@
"guid": "efc8a311-74f8-0252-c6a0-4bac7610e266",
"link": "Contact VMware",
"services": [
- "AVS",
- "Storage"
+ "Storage",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Storage",
@@ -4370,8 +7904,8 @@
"guid": "ab6c89cd-a26f-b894-fe59-61863975458e",
"link": "Contact VMware",
"services": [
- "AVS",
- "Storage"
+ "Storage",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Storage",
@@ -4385,10 +7919,10 @@
"guid": "7628d446-6b10-9678-9cec-f407d990de43",
"link": "https://learn.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance",
"services": [
- "AVS",
"VM",
+ "Storage",
"AzurePolicy",
- "Storage"
+ "AVS"
],
"severity": "Medium",
"subcategory": "Storage",
@@ -4402,10 +7936,10 @@
"guid": "37fef358-7ab9-43a9-542c-22673955200e",
"link": "https://learn.microsoft.com/azure/azure-vmware/configure-storage-policy",
"services": [
- "AVS",
"VM",
+ "Storage",
"AzurePolicy",
- "Storage"
+ "AVS"
],
"severity": "Medium",
"subcategory": "Storage",
@@ -4419,9 +7953,9 @@
"guid": "ebebd109-9f9d-d85e-1b2f-d302012843b7",
"link": "https://learn.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance",
"services": [
- "AVS",
+ "Storage",
"AzurePolicy",
- "Storage"
+ "AVS"
],
"severity": "Medium",
"subcategory": "Storage",
@@ -4435,8 +7969,8 @@
"guid": "1be821bd-4f37-216a-3e3d-2a5ac6996863",
"link": "https://learn.microsoft.com/azure/azure-vmware/netapp-files-with-azure-vmware-solution",
"services": [
- "AVS",
- "Storage"
+ "Storage",
+ "AVS"
],
"severity": "Medium",
"subcategory": "Storage",
@@ -4515,8 +8049,8 @@
"link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-outages-disasters#geo-disaster-recovery",
"services": [
"ServiceBus",
- "ASR",
- "Storage"
+ "Storage",
+ "ASR"
],
"severity": "Medium",
"subcategory": "Geo-Disaster Recovery",
@@ -4586,9 +8120,9 @@
"guid": "4a69b9d3-39ac-44e7-a68d-1d75657202b4",
"link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist",
"services": [
- "PrivateLink",
"ServiceBus",
- "Storage"
+ "Storage",
+ "PrivateLink"
],
"severity": "Medium",
"subcategory": "Best Practices",
@@ -4628,8 +8162,8 @@
"link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist",
"services": [
"ServiceBus",
- "ASR",
- "Storage"
+ "Storage",
+ "ASR"
],
"severity": "Medium",
"subcategory": "Best Practices",
@@ -4741,11 +8275,11 @@
"link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
"service": "Service Bus",
"services": [
- "Entra",
"AzurePolicy",
- "TrafficManager",
+ "Entra",
+ "ServiceBus",
"RBAC",
- "ServiceBus"
+ "TrafficManager"
],
"severity": "Medium",
"subcategory": "Identity and Access Management",
@@ -4761,12 +8295,12 @@
"link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
"service": "Service Bus",
"services": [
+ "Storage",
"Entra",
"AKV",
- "Storage",
+ "ServiceBus",
"VM",
- "AppSvc",
- "ServiceBus"
+ "AppSvc"
],
"severity": "Medium",
"subcategory": "Identity and Access Management",
@@ -4782,11 +8316,11 @@
"link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
"service": "Service Bus",
"services": [
- "Entra",
"Storage",
- "RBAC",
+ "Entra",
"Subscriptions",
- "ServiceBus"
+ "ServiceBus",
+ "RBAC"
],
"severity": "High",
"subcategory": "Identity and Access Management",
@@ -4820,9 +8354,9 @@
"link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
"service": "Service Bus",
"services": [
- "PrivateLink",
"ServiceBus",
- "VNet"
+ "VNet",
+ "PrivateLink"
],
"severity": "Medium",
"subcategory": "Networking",
@@ -5693,8 +9227,8 @@
"link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
"service": "Cognitive Services",
"services": [
- "Backup",
- "ASR"
+ "ASR",
+ "Backup"
],
"severity": "High",
"subcategory": "Backup",
@@ -5789,8 +9323,8 @@
"link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
"service": "App Services",
"services": [
- "AppSvc",
- "Monitor"
+ "Monitor",
+ "AppSvc"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -5875,8 +9409,8 @@
"link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
"service": "App Services",
"services": [
- "AppSvc",
- "Monitor"
+ "Monitor",
+ "AppSvc"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -5890,8 +9424,8 @@
"link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview",
"service": "App Services",
"services": [
- "AppSvc",
- "Monitor"
+ "Monitor",
+ "AppSvc"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -5905,8 +9439,8 @@
"link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests",
"service": "App Services",
"services": [
- "AppSvc",
- "Monitor"
+ "Monitor",
+ "AppSvc"
],
"severity": "Low",
"subcategory": "Monitoring",
@@ -5970,8 +9504,8 @@
"link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
"service": "App Services",
"services": [
- "AppSvc",
- "Subscriptions"
+ "Subscriptions",
+ "AppSvc"
],
"severity": "Medium",
"subcategory": "Data Protection",
@@ -5986,8 +9520,8 @@
"link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
"service": "App Services",
"services": [
- "AppSvc",
- "TrafficManager"
+ "TrafficManager",
+ "AppSvc"
],
"severity": "Medium",
"subcategory": "Data Protection",
@@ -6068,8 +9602,8 @@
"service": "App Services",
"services": [
"Entra",
- "AppSvc",
- "ACR"
+ "ACR",
+ "AppSvc"
],
"severity": "High",
"subcategory": "Identity and Access Control",
@@ -6084,9 +9618,9 @@
"link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
"service": "App Services",
"services": [
- "Entra",
+ "Monitor",
"AppSvc",
- "Monitor"
+ "Entra"
],
"severity": "Medium",
"subcategory": "Logging and Monitoring",
@@ -6101,9 +9635,9 @@
"link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
"service": "App Services",
"services": [
- "Entra",
+ "Monitor",
"AppSvc",
- "Monitor"
+ "Entra"
],
"severity": "Medium",
"subcategory": "Logging and Monitoring",
@@ -6118,10 +9652,10 @@
"link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
"service": "App Services",
"services": [
- "NVA",
"Monitor",
- "AppSvc",
+ "NVA",
"VNet",
+ "AppSvc",
"Firewall"
],
"severity": "Medium",
@@ -6137,11 +9671,11 @@
"link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
"service": "App Services",
"services": [
- "PrivateLink",
"Storage",
"NVA",
- "AppSvc",
"VNet",
+ "PrivateLink",
+ "AppSvc",
"Firewall"
],
"severity": "Low",
@@ -6157,8 +9691,8 @@
"link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
"service": "App Services",
"services": [
- "PrivateLink",
- "AppSvc"
+ "AppSvc",
+ "PrivateLink"
],
"severity": "High",
"subcategory": "Network Security",
@@ -6173,11 +9707,11 @@
"link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
"service": "App Services",
"services": [
+ "Monitor",
"AppGW",
+ "WAF",
"FrontDoor",
- "Monitor",
- "AppSvc",
- "WAF"
+ "AppSvc"
],
"severity": "High",
"subcategory": "Network Security",
@@ -6192,9 +9726,9 @@
"link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
"service": "App Services",
"services": [
- "PrivateLink",
+ "WAF",
"AppSvc",
- "WAF"
+ "PrivateLink"
],
"severity": "High",
"subcategory": "Network Security",
@@ -6210,8 +9744,8 @@
"link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
"service": "App Services",
"services": [
- "AppSvc",
- "AzurePolicy"
+ "AzurePolicy",
+ "AppSvc"
],
"severity": "Medium",
"subcategory": "Network Security",
@@ -6227,8 +9761,8 @@
"link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
"service": "App Services",
"services": [
- "AppSvc",
- "WAF"
+ "WAF",
+ "AppSvc"
],
"severity": "High",
"subcategory": "Network Security",
@@ -6243,8 +9777,8 @@
"link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
"service": "App Services",
"services": [
- "AppSvc",
- "Storage"
+ "Storage",
+ "AppSvc"
],
"severity": "High",
"subcategory": "Network Security",
@@ -6275,8 +9809,8 @@
"link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
"service": "App Services",
"services": [
- "AppSvc",
- "Defender"
+ "Defender",
+ "AppSvc"
],
"severity": "Medium",
"subcategory": "Network Security",
@@ -6291,13 +9825,13 @@
"link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
"service": "App Services",
"services": [
- "AppGW",
- "DDoS",
"EventHubs",
- "NVA",
- "AppSvc",
+ "AppGW",
"VNet",
- "WAF"
+ "WAF",
+ "NVA",
+ "DDoS",
+ "AppSvc"
],
"severity": "Medium",
"subcategory": "Network Security",
@@ -6312,10 +9846,10 @@
"link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
"service": "App Services",
"services": [
- "PrivateLink",
- "AppSvc",
+ "ACR",
"VNet",
- "ACR"
+ "AppSvc",
+ "PrivateLink"
],
"severity": "Medium",
"subcategory": "Network Security",
@@ -6390,8 +9924,8 @@
"link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
"service": "Azure Storage",
"services": [
- "PrivateLink",
- "Storage"
+ "Storage",
+ "PrivateLink"
],
"severity": "High",
"subcategory": "Networking",
@@ -6423,8 +9957,8 @@
"link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
"service": "Azure Storage",
"services": [
- "Storage",
- "Defender"
+ "Defender",
+ "Storage"
],
"severity": "High",
"subcategory": "Governance",
@@ -6515,8 +10049,8 @@
"service": "Azure Storage",
"services": [
"Storage",
- "Subscriptions",
- "AzurePolicy"
+ "AzurePolicy",
+ "Subscriptions"
],
"severity": "High",
"subcategory": "Data Availability, Compliance",
@@ -6571,7 +10105,23 @@
{
"category": "Security",
"checklist": "Azure Storage Review Checklist",
- "description": "AAD tokens should be favored over shared access signatures, wherever possible",
+ "description": ". Enforcing the latest TLS version will reject request from clients using the older version. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "services": [
+ "Storage"
+ ],
+ "severity": "High",
+ "subcategory": "Networking",
+ "text": "Enforce the latest TLS version for a storage account",
+ "waf": "Security"
+ },
+ {
+ "category": "Security",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Microsoft Entra ID tokens should be favored over shared access signatures, wherever possible",
"guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
"link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
"service": "Azure Storage",
@@ -6581,7 +10131,7 @@
],
"severity": "High",
"subcategory": "Identity and Access Management",
- "text": "Use Azure Active Directory (Azure AD) tokens for blob access",
+ "text": "Use Microsoft Entra ID tokens for blob access",
"waf": "Security"
},
{
@@ -6619,19 +10169,20 @@
{
"category": "Security",
"checklist": "Azure Storage Review Checklist",
- "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on AAD authentication makes it easier to tie storage access to a user. ",
+ "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on Entra ID authentication makes it easier to tie storage access to a user. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
"guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
"link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
"service": "Azure Storage",
"services": [
"Entra",
- "AKV",
"Storage",
- "Monitor"
+ "Monitor",
+ "AKV"
],
"severity": "High",
"subcategory": "Identity and Access Management",
- "text": "Consider disabling storage account keys, so that only AAD access (and user delegation SAS) is supported.",
+ "text": "Consider disabling storage account keys, so that only Microsoft Entra ID access (and user delegation SAS) is supported.",
"waf": "Security"
},
{
@@ -6642,10 +10193,10 @@
"link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
"service": "Azure Storage",
"services": [
- "AKV",
+ "Monitor",
"Storage",
"AzurePolicy",
- "Monitor"
+ "AKV"
],
"severity": "High",
"subcategory": "Monitoring",
@@ -6661,9 +10212,9 @@
"service": "Azure Storage",
"services": [
"Entra",
- "AKV",
"Storage",
- "AzurePolicy"
+ "AzurePolicy",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Identity and Access Management",
@@ -6696,9 +10247,9 @@
"service": "Azure Storage",
"services": [
"Entra",
- "AKV",
"Storage",
- "AzurePolicy"
+ "AzurePolicy",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Identity and Access Management",
@@ -6712,8 +10263,8 @@
"link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
"service": "Azure Storage",
"services": [
- "AKV",
- "Storage"
+ "Storage",
+ "AKV"
],
"severity": "Medium",
"subcategory": "CI/CD",
@@ -6895,6 +10446,7 @@
"category": "Security",
"checklist": "Azure Storage Review Checklist",
"description": "Leverage Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) to find storage accounts which allow anonymous blob access.",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
"guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
"link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
"service": "Azure Storage",
@@ -6904,7 +10456,7 @@
],
"severity": "High",
"subcategory": "Identity and Access Management",
- "text": "Consider whether public blob access is needed, or whether it can be disabled for certain storage accounts. ",
+ "text": "Consider whether public blob anonymous access is needed, or whether it can be disabled for certain storage accounts. ",
"waf": "Security"
},
{
@@ -7017,11 +10569,11 @@
"link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
"service": "Event Hubs",
"services": [
- "Entra",
+ "EventHubs",
"AzurePolicy",
+ "Entra",
"RBAC",
- "TrafficManager",
- "EventHubs"
+ "TrafficManager"
],
"severity": "Medium",
"subcategory": "Identity and Access Management",
@@ -7037,11 +10589,11 @@
"link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
"service": "Event Hubs",
"services": [
+ "EventHubs",
+ "Storage",
"Entra",
"AKV",
- "Storage",
- "VM",
- "EventHubs"
+ "VM"
],
"severity": "Medium",
"subcategory": "Identity and Access Management",
@@ -7075,9 +10627,9 @@
"link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
"service": "Event Hubs",
"services": [
+ "Monitor",
"EventHubs",
- "VNet",
- "Monitor"
+ "VNet"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -7093,9 +10645,9 @@
"link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
"service": "Event Hubs",
"services": [
- "PrivateLink",
"EventHubs",
- "VNet"
+ "VNet",
+ "PrivateLink"
],
"severity": "Medium",
"subcategory": "Networking",
@@ -7216,8 +10768,8 @@
"link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
"service": "Front Door",
"services": [
- "AKV",
- "FrontDoor"
+ "FrontDoor",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Front Door",
@@ -7289,8 +10841,8 @@
"link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
"service": "App Gateway",
"services": [
- "VNet",
- "AppGW"
+ "AppGW",
+ "VNet"
],
"severity": "Medium",
"subcategory": "App Gateway",
@@ -7308,10 +10860,10 @@
"services": [
"Entra",
"AppGW",
- "Subscriptions",
- "NVA",
"VNet",
- "WAF"
+ "WAF",
+ "NVA",
+ "Subscriptions"
],
"severity": "Medium",
"subcategory": "App Gateway",
@@ -7372,9 +10924,9 @@
"link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
"service": "Front Door",
"services": [
- "WAF",
"AzurePolicy",
- "FrontDoor"
+ "FrontDoor",
+ "WAF"
],
"severity": "Medium",
"subcategory": "Front Door",
@@ -7390,9 +10942,9 @@
"service": "Front Door",
"services": [
"AppGW",
- "WAF",
"AzurePolicy",
- "FrontDoor"
+ "FrontDoor",
+ "WAF"
],
"severity": "Medium",
"subcategory": "App delivery",
@@ -7423,8 +10975,8 @@
"link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
"service": "Entra",
"services": [
- "Entra",
- "AVD"
+ "AVD",
+ "Entra"
],
"severity": "Low",
"subcategory": "App delivery",
@@ -7456,9 +11008,9 @@
"link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
"service": "Front Door",
"services": [
- "WAF",
"AzurePolicy",
- "FrontDoor"
+ "FrontDoor",
+ "WAF"
],
"severity": "High",
"subcategory": "Front Door",
@@ -7565,9 +11117,9 @@
"link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
"service": "Front Door",
"services": [
- "AKV",
"Cost",
- "FrontDoor"
+ "FrontDoor",
+ "AKV"
],
"severity": "High",
"subcategory": "Front Door",
@@ -7581,8 +11133,8 @@
"link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
"service": "Front Door",
"services": [
- "FrontDoor",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "Medium",
"subcategory": "Front Door",
@@ -7626,8 +11178,8 @@
"link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
"service": "Front Door",
"services": [
- "FrontDoor",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "High",
"subcategory": "Front Door",
@@ -7642,8 +11194,8 @@
"link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
"service": "Front Door",
"services": [
- "FrontDoor",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "High",
"subcategory": "Front Door",
@@ -7658,9 +11210,9 @@
"link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
"service": "Front Door",
"services": [
- "WAF",
"AzurePolicy",
- "FrontDoor"
+ "FrontDoor",
+ "WAF"
],
"severity": "High",
"subcategory": "Front Door",
@@ -7675,8 +11227,8 @@
"link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
"service": "Front Door",
"services": [
- "FrontDoor",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "High",
"subcategory": "Front Door",
@@ -7691,8 +11243,8 @@
"link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
"service": "Front Door",
"services": [
- "FrontDoor",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "High",
"subcategory": "Front Door",
@@ -7706,8 +11258,8 @@
"link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
"service": "Front Door",
"services": [
- "FrontDoor",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "Medium",
"subcategory": "Front Door",
@@ -7721,8 +11273,8 @@
"link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
"service": "Front Door",
"services": [
- "FrontDoor",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "Medium",
"subcategory": "Front Door",
@@ -7736,8 +11288,8 @@
"link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
"service": "Front Door",
"services": [
- "FrontDoor",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "Medium",
"subcategory": "Front Door",
@@ -7765,8 +11317,8 @@
"link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
"service": "Front Door",
"services": [
- "FrontDoor",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "Medium",
"subcategory": "Front Door",
@@ -7935,8 +11487,8 @@
"link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
"service": "Front Door",
"services": [
- "FrontDoor",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "Medium",
"subcategory": "Front Door",
@@ -7967,8 +11519,8 @@
"service": "Front Door",
"services": [
"Sentinel",
- "FrontDoor",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "Medium",
"subcategory": "Front Door",
@@ -8012,10 +11564,10 @@
"link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
"service": "App Gateway",
"services": [
- "VPN",
- "VNet",
"AppGW",
- "ExpressRoute"
+ "VNet",
+ "ExpressRoute",
+ "VPN"
],
"severity": "Medium",
"subcategory": "App Gateway",
@@ -8280,8 +11832,8 @@
"guid": "b94ee5ef-47d2-4d92-a81b-1cd6d1f54b29",
"link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/sharing-metadata-across-different-databricks-workspaces-using/ba-p/3679757",
"services": [
- "Backup",
- "ACR"
+ "ACR",
+ "Backup"
],
"severity": "Medium",
"subcategory": "Backup",
@@ -8294,8 +11846,8 @@
"guid": "769e3969-0e78-428a-a936-657d03b0f466",
"link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/disaster-recovery-strategy-in-azure-databricks-using-the-hive/ba-p/3684581",
"services": [
- "Backup",
- "ASR"
+ "ASR",
+ "Backup"
],
"severity": "Medium",
"subcategory": "Backup",
@@ -8484,11 +12036,11 @@
"link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
"services": [
"Entra",
- "DDoS",
- "Subscriptions",
"VNet",
- "Firewall",
- "WAF"
+ "Subscriptions",
+ "WAF",
+ "DDoS",
+ "Firewall"
],
"severity": "Low",
"subcategory": "DDoS",
@@ -8512,8 +12064,8 @@
"guid": "44008ae7-d7e4-4743-876c-8bdbf55bce61",
"link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
"services": [
- "FrontDoor",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "Medium",
"subcategory": "Internet",
@@ -8526,8 +12078,8 @@
"guid": "9e8a03f9-7879-4424-b626-786d60b96c97",
"link": "https://learn.microsoft.com/azure/openshift/howto-secure-openshift-with-front-door",
"services": [
- "PrivateLink",
- "FrontDoor"
+ "FrontDoor",
+ "PrivateLink"
],
"severity": "Medium",
"subcategory": "Internet",
@@ -8540,8 +12092,8 @@
"guid": "be985190-4838-435c-a86b-b2912155a114",
"link": "https://learn.microsoft.com/azure/openshift/howto-restrict-egress",
"services": [
- "AzurePolicy",
"NVA",
+ "AzurePolicy",
"Firewall"
],
"severity": "Medium",
@@ -8568,8 +12120,8 @@
"guid": "ab039da6-d54d-47c8-a29d-b107d5325ae6",
"link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
"services": [
- "PrivateLink",
- "ACR"
+ "ACR",
+ "PrivateLink"
],
"severity": "Medium",
"subcategory": "Private access",
@@ -8856,8 +12408,8 @@
"guid": "76af4a69-1e88-439a-ba46-667e13c10567",
"link": "https://learn.microsoft.com/azure/openshift/howto-segregate-machinesets",
"services": [
- "VNet",
- "AKS"
+ "AKS",
+ "VNet"
],
"severity": "Medium",
"subcategory": "Cluster Design",
@@ -8941,8 +12493,8 @@
"guid": "08fe8273-4c48-46ba-880d-c0591cf75ee8",
"link": "https://learn.microsoft.com/azure/azure-arc/kubernetes/quickstart-connect-cluster",
"services": [
- "Arc",
- "AKS"
+ "AKS",
+ "Arc"
],
"severity": "High",
"subcategory": "Control plane",
@@ -8966,9 +12518,9 @@
"guid": "d55d14c3-c492-49cb-8b3d-1325ae124ba3",
"link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
"services": [
- "Arc",
"Defender",
- "AKS"
+ "AKS",
+ "Arc"
],
"severity": "Medium",
"subcategory": "Posture",
@@ -8981,9 +12533,9 @@
"guid": "4d0685ed-dce9-4be3-ab0d-db3b55fb2ec1",
"link": "https://learn.microsoft.com/azure/azure-arc/kubernetes/tutorial-akv-secrets-provider",
"services": [
- "AKV",
+ "AKS",
"Arc",
- "AKS"
+ "AKV"
],
"severity": "Medium",
"subcategory": "Secrets",
@@ -9007,8 +12559,8 @@
"guid": "b4935ada-4232-44ec-b81c-123181a64174",
"link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes#install-azure-policy-extension-for-azure-arc-enabled-kubernetes",
"services": [
- "AzurePolicy",
- "Monitor"
+ "Monitor",
+ "AzurePolicy"
],
"severity": "Medium",
"subcategory": "Workload",
@@ -9034,8 +12586,8 @@
"guid": "e209d4a0-da57-4778-924d-216785d2fa56",
"link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
"services": [
- "Subscriptions",
- "ACR"
+ "ACR",
+ "Subscriptions"
],
"severity": "Low",
"subcategory": "Workload",
@@ -9280,8 +12832,8 @@
"guid": "c851fd44-7cf1-459c-95a4-f6455d75a981",
"link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/cost-management-allocation",
"services": [
- "Cost",
- "Monitor"
+ "Monitor",
+ "Cost"
],
"severity": "Medium",
"subcategory": "Cost Optimization",
@@ -9446,8 +12998,8 @@
"guid": "f785b143-2c1e-4466-9baa-dde8ba4c7aaa",
"link": "https://learn.microsoft.com/azure-stack/hci/concepts/fault-tolerance#parity",
"services": [
- "Backup",
- "Storage"
+ "Storage",
+ "Backup"
],
"severity": "Medium",
"subcategory": "S2D",
@@ -9812,9 +13364,9 @@
"guid": "074541e3-fe08-458a-8062-32d13dcc10c6",
"link": "https://learn.microsoft.com/azure/backup/back-up-azure-stack-hyperconverged-infrastructure-virtual-machines",
"services": [
- "Backup",
"VM",
- "ASR"
+ "ASR",
+ "Backup"
],
"severity": "High",
"subcategory": "VM",
@@ -10002,8 +13554,8 @@
"guid": "8ea49f70-1038-4283-b0c4-230165d3eabc",
"link": "https://learn.microsoft.com/azure-stack/hci/manage/azure-site-recovery",
"services": [
- "Backup",
- "ASR"
+ "ASR",
+ "Backup"
],
"severity": "Medium",
"subcategory": "Disaster Recovery",
@@ -10104,9 +13656,9 @@
"link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
"service": "Azure OpenAI",
"services": [
- "AKV",
+ "Monitor",
"Subscriptions",
- "Monitor"
+ "AKV"
],
"severity": "High",
"subcategory": "Alerts",
@@ -10248,8 +13800,8 @@
"link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
"service": "Azure OpenAI",
"services": [
- "Storage",
- "ServiceBus"
+ "ServiceBus",
+ "Storage"
],
"severity": "Medium",
"subcategory": "Elasticity segregation",
@@ -10378,8 +13930,8 @@
"link": "https://learn.microsoft.com/azure/backup/backup-overview",
"service": "Azure OpenAI",
"services": [
- "Backup",
- "ASR"
+ "ASR",
+ "Backup"
],
"severity": "Medium",
"subcategory": "Data Backup and Disaster Recovery",
@@ -10469,8 +14021,8 @@
"link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction",
"service": "Azure OpenAI",
"services": [
- "Sentinel",
"Defender",
+ "Sentinel",
"Monitor"
],
"severity": "High",
@@ -10858,8 +14410,8 @@
"link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
"service": "Azure OpenAI",
"services": [
- "Cost",
- "Monitor"
+ "Monitor",
+ "Cost"
],
"severity": "Medium",
"subcategory": "Cost monitoring",
@@ -11039,9 +14591,9 @@
"service": "Azure OpenAI",
"services": [
"Entra",
+ "ACR",
"APIM",
- "LoadBalancer",
- "ACR"
+ "LoadBalancer"
],
"severity": "Medium",
"subcategory": "Load Balancing",
@@ -11335,10 +14887,10 @@
"guid": "170265f4-bb46-4a39-9af7-f317284797b1",
"link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
"services": [
- "LoadBalancer",
"TrafficManager",
+ "AKS",
"FrontDoor",
- "AKS"
+ "LoadBalancer"
],
"severity": "Medium",
"subcategory": "High Availability",
@@ -11396,8 +14948,8 @@
"link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
"service": "ACR",
"services": [
- "ACR",
- "AKS"
+ "AKS",
+ "ACR"
],
"severity": "High",
"subcategory": "High Availability",
@@ -11411,8 +14963,8 @@
"link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
"services": [
"Storage",
- "ASR",
- "AKS"
+ "AKS",
+ "ASR"
],
"severity": "High",
"subcategory": "Disaster Recovery",
@@ -11500,8 +15052,8 @@
"link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
"service": "AKS",
"services": [
- "AzurePolicy",
- "AKS"
+ "AKS",
+ "AzurePolicy"
],
"severity": "Medium",
"subcategory": "Compliance",
@@ -11544,8 +15096,8 @@
"link": "https://learn.microsoft.com/azure/container-registry/",
"service": "AKS",
"services": [
- "ACR",
- "AKS"
+ "AKS",
+ "ACR"
],
"severity": "Medium",
"subcategory": "Compliance",
@@ -11614,8 +15166,8 @@
"link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
"service": "AKS",
"services": [
- "AKV",
- "AKS"
+ "AKS",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Secrets",
@@ -11629,8 +15181,8 @@
"link": "https://learn.microsoft.com/azure/aks/update-credentials",
"service": "AKS",
"services": [
- "AKV",
- "AKS"
+ "AKS",
+ "AKV"
],
"severity": "High",
"subcategory": "Secrets",
@@ -11644,8 +15196,8 @@
"link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
"service": "AKS",
"services": [
- "AKV",
- "AKS"
+ "AKS",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Secrets",
@@ -11659,8 +15211,8 @@
"link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
"service": "AKS",
"services": [
- "AKV",
- "AKS"
+ "AKS",
+ "AKV"
],
"severity": "Low",
"subcategory": "Secrets",
@@ -11674,9 +15226,9 @@
"link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
"service": "AKS",
"services": [
- "AKV",
"Defender",
- "AKS"
+ "AKS",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Secrets",
@@ -11875,9 +15427,9 @@
"link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
"service": "AKS",
"services": [
+ "AKS",
"ACR",
- "AppGW",
- "AKS"
+ "AppGW"
],
"severity": "Medium",
"subcategory": "Best practices",
@@ -11921,8 +15473,8 @@
"link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
"service": "AKS",
"services": [
- "LoadBalancer",
- "AKS"
+ "AKS",
+ "LoadBalancer"
],
"severity": "High",
"subcategory": "Best practices",
@@ -11936,8 +15488,8 @@
"link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
"service": "AKS",
"services": [
- "VNet",
- "AKS"
+ "AKS",
+ "VNet"
],
"severity": "Medium",
"subcategory": "Best practices",
@@ -11951,10 +15503,10 @@
"link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
"service": "AKS",
"services": [
- "PrivateLink",
- "VNet",
"Cost",
- "AKS"
+ "AKS",
+ "VNet",
+ "PrivateLink"
],
"severity": "Medium",
"subcategory": "Cost",
@@ -11967,8 +15519,8 @@
"guid": "e8a03f97-8794-468d-96a7-86d60f96c97b",
"link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
"services": [
- "VPN",
- "AKS"
+ "AKS",
+ "VPN"
],
"severity": "Medium",
"subcategory": "HA",
@@ -11997,8 +15549,8 @@
"link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
"service": "AKS",
"services": [
- "VNet",
- "AKS"
+ "AKS",
+ "VNet"
],
"severity": "High",
"subcategory": "IPAM",
@@ -12027,8 +15579,8 @@
"link": "https://learn.microsoft.com/azure/aks/internal-lb",
"service": "AKS",
"services": [
- "VNet",
- "AKS"
+ "AKS",
+ "VNet"
],
"severity": "Low",
"subcategory": "IPAM",
@@ -12127,8 +15679,8 @@
"link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
"service": "AKS",
"services": [
- "NVA",
- "AKS"
+ "AKS",
+ "NVA"
],
"severity": "High",
"subcategory": "Security",
@@ -12173,8 +15725,8 @@
"link": "https://learn.microsoft.com/azure/aks/use-network-policies",
"service": "AKS",
"services": [
- "AzurePolicy",
- "AKS"
+ "AKS",
+ "AzurePolicy"
],
"severity": "Medium",
"subcategory": "Security",
@@ -12189,8 +15741,8 @@
"link": "https://learn.microsoft.com/azure/aks/use-network-policies",
"service": "AKS",
"services": [
- "AzurePolicy",
- "AKS"
+ "AKS",
+ "AzurePolicy"
],
"severity": "High",
"subcategory": "Security",
@@ -12204,8 +15756,8 @@
"link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
"service": "AKS",
"services": [
- "AzurePolicy",
- "AKS"
+ "AKS",
+ "AzurePolicy"
],
"severity": "High",
"subcategory": "Security",
@@ -12219,8 +15771,8 @@
"link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
"service": "AKS",
"services": [
- "WAF",
- "AKS"
+ "AKS",
+ "WAF"
],
"severity": "High",
"subcategory": "Security",
@@ -12235,9 +15787,9 @@
"link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
"service": "AKS",
"services": [
+ "AKS",
"VNet",
- "DDoS",
- "AKS"
+ "DDoS"
],
"severity": "Medium",
"subcategory": "Security",
@@ -12602,9 +16154,9 @@
"link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
"service": "AKS",
"services": [
- "Storage",
"Monitor",
"EventHubs",
+ "Storage",
"ServiceBus",
"AKS"
],
@@ -12620,10 +16172,10 @@
"link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
"service": "AKS",
"services": [
- "LoadBalancer",
"Monitor",
- "NVA",
- "AKS"
+ "AKS",
+ "LoadBalancer",
+ "NVA"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -12680,8 +16232,8 @@
"link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
"service": "AKS",
"services": [
- "Subscriptions",
- "AKS"
+ "AKS",
+ "Subscriptions"
],
"severity": "High",
"subcategory": "Resources",
@@ -12871,8 +16423,8 @@
"service": "AKS",
"services": [
"Storage",
- "SQL",
- "AKS"
+ "AKS",
+ "SQL"
],
"severity": "Medium",
"subcategory": "Storage",
@@ -12916,8 +16468,8 @@
"link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
"service": "Azure Monitor",
"services": [
- "Cost",
- "Monitor"
+ "Monitor",
+ "Cost"
],
"severity": "Medium",
"subcategory": "Azure Monitor - enforce data collection rules",
@@ -12932,8 +16484,8 @@
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
"service": "Azure Backup",
"services": [
- "Backup",
- "Cost"
+ "Cost",
+ "Backup"
],
"severity": "Medium",
"subcategory": "Backup",
@@ -12973,9 +16525,9 @@
"guid": "3b0d834a-3487-426d-b69c-6b5c2a26494b",
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
"services": [
- "Backup",
"Storage",
- "Cost"
+ "Cost",
+ "Backup"
],
"severity": "Medium",
"subcategory": "Delete/archive",
@@ -12989,9 +16541,9 @@
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
"service": "Azure Backup",
"services": [
- "Backup",
"Storage",
"Cost",
+ "Backup",
"ASR"
],
"severity": "Medium",
@@ -13006,8 +16558,8 @@
"link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
"service": "Azure Monitor",
"services": [
- "Cost",
- "Monitor"
+ "Monitor",
+ "Cost"
],
"severity": "Medium",
"subcategory": "Log Analytics retention for workspaces",
@@ -13068,9 +16620,9 @@
"service": "VM",
"services": [
"VM",
- "Backup",
"Storage",
- "Cost"
+ "Cost",
+ "Backup"
],
"severity": "Medium",
"subcategory": "stopped/deallocated VMs: check disks",
@@ -13210,8 +16762,8 @@
"guid": "b835556d-f2bf-4e45-93b0-d834a348726d",
"link": "https://learn.microsoft.com/azure/governance/policy/overview",
"services": [
- "Cost",
- "Monitor"
+ "Monitor",
+ "Cost"
],
"severity": "Medium",
"subcategory": "Automation",
@@ -13399,8 +16951,8 @@
"service": "VM",
"services": [
"VM",
- "SQL",
"Cost",
+ "SQL",
"AzurePolicy"
],
"severity": "Medium",
@@ -13415,8 +16967,8 @@
"link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
"service": "VM",
"services": [
- "LoadBalancer",
- "Cost"
+ "Cost",
+ "LoadBalancer"
],
"severity": "Medium",
"subcategory": "Check Red Hat Licences if applicable",
@@ -13429,8 +16981,8 @@
"guid": "a76af4a6-91e8-4839-ada4-6667e13c1056",
"link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
"services": [
- "AppSvc",
- "Cost"
+ "Cost",
+ "AppSvc"
],
"severity": "Medium",
"subcategory": "Functions",
@@ -13461,8 +17013,8 @@
"service": "VM",
"services": [
"VM",
- "ARS",
- "Cost"
+ "Cost",
+ "ARS"
],
"severity": "Medium",
"subcategory": "Reservations/savings plans",
@@ -13532,8 +17084,8 @@
"link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
"service": "Azure SQL",
"services": [
- "SQL",
"Cost",
+ "SQL",
"AzurePolicy"
],
"severity": "Medium",
@@ -13549,8 +17101,8 @@
"service": "VM",
"services": [
"VM",
- "SQL",
- "Cost"
+ "Cost",
+ "SQL"
],
"severity": "Medium",
"subcategory": "SQL Database Reservations",
@@ -13688,8 +17240,8 @@
"link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
"service": "Azure Backup",
"services": [
- "Backup",
- "Cost"
+ "Cost",
+ "Backup"
],
"severity": "Medium",
"subcategory": "Backup",
@@ -13704,9 +17256,9 @@
"link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
"service": "Databricks",
"services": [
- "LoadBalancer",
+ "VM",
"Cost",
- "VM"
+ "LoadBalancer"
],
"severity": "Medium",
"subcategory": "Databricks",
@@ -13852,9 +17404,9 @@
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
"service": "Front Door",
"services": [
- "AppSvc",
"Cost",
- "FrontDoor"
+ "FrontDoor",
+ "AppSvc"
],
"severity": "Medium",
"subcategory": "Networking",
@@ -13954,9 +17506,9 @@
"link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
"service": "Site Recovery",
"services": [
- "ASR",
+ "Storage",
"Cost",
- "Storage"
+ "ASR"
],
"severity": "Medium",
"subcategory": "Storage",
@@ -14000,9 +17552,9 @@
"link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
"service": "Synapse",
"services": [
+ "Monitor",
"EventHubs",
- "Cost",
- "Monitor"
+ "Cost"
],
"severity": "Medium",
"subcategory": "Synapse",
@@ -14031,8 +17583,8 @@
"link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
"service": "Synapse",
"services": [
- "SQL",
- "Cost"
+ "Cost",
+ "SQL"
],
"severity": "Medium",
"subcategory": "Synapse",
@@ -14248,8 +17800,8 @@
"service": "Cognitive Search",
"services": [
"Storage",
- "Backup",
- "ASR"
+ "ASR",
+ "Backup"
],
"severity": "High",
"subcategory": "Disaster Recovery",
@@ -14340,8 +17892,8 @@
"link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage",
"services": [
"Storage",
- "SQL",
- "Cost"
+ "Cost",
+ "SQL"
],
"severity": "High",
"subcategory": "Storage",
@@ -14466,8 +18018,8 @@
"services": [
"VM",
"SQL",
- "LoadBalancer",
- "VNet"
+ "VNet",
+ "LoadBalancer"
],
"severity": "Medium",
"subcategory": "HADR",
@@ -14510,10 +18062,10 @@
"guid": "667313c4-0567-44b5-b985-b859c773e7e2",
"link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/availability-group-vnn-azure-load-balancer-configure?view=azuresql-vm&tabs=ilb",
"services": [
- "LoadBalancer",
+ "VM",
"SQL",
"VNet",
- "VM"
+ "LoadBalancer"
],
"severity": "High",
"subcategory": "HADR",
@@ -14679,8 +18231,8 @@
"services": [
"VM",
"Storage",
- "SQL",
- "Cost"
+ "Cost",
+ "SQL"
],
"severity": "Low",
"subcategory": "Cost Optimization",
@@ -14695,8 +18247,8 @@
"guid": "7ed67178-b824-4546-ae1a-ee3453aec823",
"link": "https://azure.microsoft.com/en-ca/pricing/hybrid-benefit/",
"services": [
- "SQL",
- "Cost"
+ "Cost",
+ "SQL"
],
"severity": "Low",
"subcategory": "Cost Optimization",
@@ -14865,8 +18417,8 @@
"guid": "c9a7f821-b8eb-48c0-aa77-e25e4d5aeaa8",
"link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/vnet-existing-add-subnet?view=azuresql-mi",
"services": [
- "VNet",
- "SQL"
+ "SQL",
+ "VNet"
],
"severity": "Medium",
"subcategory": "Pre Migration",
@@ -14881,8 +18433,8 @@
"guid": "dc4e2436-bb33-46d7-85f1-7960eee0b9b5",
"link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/vnet-subnet-determine-size?view=azuresql-mi",
"services": [
- "VNet",
- "SQL"
+ "SQL",
+ "VNet"
],
"severity": "High",
"subcategory": "Deployment",
@@ -15016,8 +18568,8 @@
"guid": "3334fdf9-1c23-4418-8b65-275269440b4b",
"link": "https://learn.microsoft.com/azure/azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-guide?view=azuresql-mi#backup-and-restore",
"services": [
- "Backup",
- "SQL"
+ "SQL",
+ "Backup"
],
"severity": "Low",
"subcategory": "Migration",
@@ -15073,9 +18625,9 @@
"guid": "141acdce-5793-477b-adb3-751ab2ac1fad",
"link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/auto-failover-group-configure-sql-mi?view=azuresql&tabs=azure-portal#test-failover",
"services": [
- "LoadBalancer",
"EventHubs",
- "SQL"
+ "SQL",
+ "LoadBalancer"
],
"severity": "High",
"subcategory": "Post Migration",
@@ -15105,10 +18657,10 @@
"guid": "35ad9422-23e1-4381-8523-081a94174158",
"link": "https://learn.microsoft.com/azure/architecture/example-scenario/data/sql-managed-instance-cmk",
"services": [
- "AKV",
- "Backup",
"SQL",
- "AzurePolicy"
+ "AzurePolicy",
+ "AKV",
+ "Backup"
],
"severity": "Low",
"subcategory": "Post Migration",
@@ -15138,10 +18690,10 @@
"guid": "9d89f2e8-7778-4424-b516-785c6fa96b96",
"link": "https://learn.microsoft.com/azure/azure-sql/database/long-term-retention-overview?view=azuresql-mi",
"services": [
- "ARS",
- "Backup",
+ "Storage",
"SQL",
- "Storage"
+ "ARS",
+ "Backup"
],
"severity": "Low",
"subcategory": "Post Migration",
@@ -15156,8 +18708,8 @@
"guid": "ad88408f-3727-434c-a76b-a28021459014",
"link": "https://azure.microsoft.com/en-gb/pricing/hybrid-benefit/#overview",
"services": [
- "SQL",
- "Cost"
+ "Cost",
+ "SQL"
],
"severity": "Low",
"subcategory": "Post Migration",
@@ -15172,8 +18724,8 @@
"guid": "65d38e53-f9cc-4bd8-9926-6acca274faa1",
"link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-overview?view=azuresql",
"services": [
- "SQL",
- "Defender"
+ "Defender",
+ "SQL"
],
"severity": "Medium",
"subcategory": "Post Migration",
@@ -15215,8 +18767,8 @@
"link": "https://learn.microsoft.com/azure/reliability/reliability-traffic-manager?toc=%2Fazure%2Fdns%2Ftoc.json",
"services": [
"DNS",
- "TrafficManager",
- "ASR"
+ "ASR",
+ "TrafficManager"
],
"severity": "Medium",
"subcategory": "Azure DNS",
@@ -15256,8 +18808,8 @@
"guid": "2676ae46-691e-4883-9ad9-42223e138105",
"link": "https://learn.microsoft.com/azure/reliability/reliability-virtual-machines?toc=%2Fazure%2Fvirtual-machines%2Ftoc.json&bc=%2Fazure%2Fvirtual-machines%2Fbreadcrumb%2Ftoc.json&tabs=graph",
"services": [
- "DNS",
- "VM"
+ "VM",
+ "DNS"
],
"severity": "Medium",
"subcategory": "VM Based DNS Service",
@@ -15270,9 +18822,9 @@
"guid": "23081a94-1741-4583-9ff7-ad7c6d373316",
"link": "https://www.windows-active-directory.com/azure-ad-dns-for-custom-domain-names-with-advanced-dns-settings.html",
"services": [
+ "Entra",
"DNS",
- "VM",
- "Entra"
+ "VM"
],
"severity": "Medium",
"subcategory": "VM Based DNS Service",
@@ -15397,8 +18949,8 @@
"services": [
"Storage",
"Cost",
- "ASR",
- "AzurePolicy"
+ "AzurePolicy",
+ "ASR"
],
"subcategory": "DR Configuration",
"text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration",
@@ -15450,9 +19002,9 @@
"guid": "56c57ba5-9119-4bf8-b8f5-c586c7d9cdc1",
"link": "https://azure.microsoft.com/support/legal/sla/virtual-desktop/v1_0/",
"services": [
- "VM",
- "ASR",
"AVD",
+ "ASR",
+ "VM",
"Subscriptions"
],
"severity": "High",
@@ -15467,10 +19019,10 @@
"guid": "6acc076e-f9b1-441a-a989-579e76b897e7",
"link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/azure-virtual-desktop-multi-region-bcdr",
"services": [
- "VM",
+ "AVD",
"Storage",
"ASR",
- "AVD"
+ "VM"
],
"severity": "Medium",
"subcategory": "Compute",
@@ -15484,8 +19036,8 @@
"guid": "10a7da7b-e996-46e1-9d3c-4ada97cc3d13",
"link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery",
"services": [
- "ASR",
- "AVD"
+ "AVD",
+ "ASR"
],
"severity": "Low",
"subcategory": "Compute",
@@ -15499,8 +19051,8 @@
"guid": "25ab225c-6f4e-4168-9fdd-dea8a4b7cdeb",
"link": "https://techcommunity.microsoft.com/t5/azure-virtual-desktop-blog/announcing-general-availability-of-support-for-azure/ba-p/3636262",
"services": [
- "ASR",
"AVD",
+ "ASR",
"ACR"
],
"severity": "High",
@@ -15515,10 +19067,10 @@
"guid": "4c61fc3f-c14e-4ea6-b69e-8d9a3eec218e",
"link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery",
"services": [
- "Backup",
- "VM",
"AVD",
- "ASR"
+ "ASR",
+ "VM",
+ "Backup"
],
"severity": "Medium",
"subcategory": "Compute",
@@ -15532,10 +19084,10 @@
"guid": "5da58639-ca3a-4961-890b-29663c5e10d",
"link": "https://learn.microsoft.com/azure/site-recovery/azure-to-azure-how-to-enable-zone-to-zone-disaster-recovery",
"services": [
- "Backup",
+ "AVD",
"VM",
"ASR",
- "AVD",
+ "Backup",
"Cost"
],
"severity": "Medium",
@@ -15551,9 +19103,9 @@
"link": "https://learn.microsoft.com/azure/virtual-machines/azure-compute-gallery",
"services": [
"Storage",
+ "AVD",
"VM",
"ASR",
- "AVD",
"ACR"
],
"severity": "Low",
@@ -15568,8 +19120,8 @@
"guid": "fd339489-8c12-488b-9c6a-57cfb644451e",
"link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery",
"services": [
- "ASR",
- "AVD"
+ "AVD",
+ "ASR"
],
"severity": "Medium",
"subcategory": "Dependencies",
@@ -15583,9 +19135,9 @@
"guid": "687ab077-adb5-49e5-a960-3334fdf8cc23",
"link": "https://docs.microsoft.com/fslogix/manage-profile-content-cncpt",
"services": [
+ "AVD",
"Storage",
- "ASR",
- "AVD"
+ "ASR"
],
"severity": "Medium",
"subcategory": "Storage",
@@ -15600,10 +19152,10 @@
"link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery",
"services": [
"Storage",
- "Backup",
- "ASR",
+ "AzurePolicy",
"AVD",
- "AzurePolicy"
+ "ASR",
+ "Backup"
],
"severity": "Medium",
"subcategory": "Storage",
@@ -15617,9 +19169,9 @@
"guid": "9f7547c1-746d-4c56-868a-714435bd09dd",
"link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery",
"services": [
+ "AVD",
"Storage",
- "ASR",
- "AVD"
+ "ASR"
],
"severity": "Medium",
"subcategory": "Storage",
@@ -15633,10 +19185,10 @@
"guid": "3d4f3537-c134-46dc-9602-7a71efe1bd05",
"link": "https://docs.microsoft.com/azure/backup/backup-afs",
"services": [
- "Backup",
+ "AVD",
"Storage",
- "ASR",
- "AVD"
+ "Backup",
+ "ASR"
],
"severity": "Medium",
"subcategory": "Storage",
@@ -15650,9 +19202,9 @@
"guid": "10d4e875-d502-4142-a795-f2b6eff34f88",
"link": "https://learn.microsoft.com/azure/storage/files/files-redundancy#zone-redundant-storage",
"services": [
+ "AVD",
"Storage",
- "ASR",
- "AVD"
+ "ASR"
],
"severity": "High",
"subcategory": "Storage",
@@ -15666,11 +19218,11 @@
"guid": "23429db7-2281-4376-85cc-57b4a4b18142",
"link": "https://learn.microsoft.com/azure/azure-netapp-files/cross-region-replication-create-peering",
"services": [
- "Backup",
"Storage",
- "ASR",
"AVD",
- "ACR"
+ "ASR",
+ "ACR",
+ "Backup"
],
"severity": "Medium",
"subcategory": "Storage",
@@ -15726,9 +19278,9 @@
"guid": "5a2adb2c-3e23-426b-b225-ca44e1696fdd",
"link": "https://learn.microsoft.com/azure/virtual-machines/shared-image-galleries",
"services": [
+ "AVD",
"Storage",
- "VM",
- "AVD"
+ "VM"
],
"severity": "Low",
"subcategory": "Golden Images",
@@ -15784,8 +19336,8 @@
"guid": "829e3fec-2183-4687-a017-7a2b5945bda4",
"link": "https://github.com/The-Virtual-Desktop-Team/Virtual-Desktop-Optimization-Tool",
"services": [
- "RBAC",
- "AVD"
+ "AVD",
+ "RBAC"
],
"severity": "Low",
"subcategory": "Golden Images",
@@ -15799,8 +19351,8 @@
"guid": "e3d3e084-4276-4d4b-bc01-5bcf219e4a1e",
"link": "https://learn.microsoft.com/azure/virtual-desktop/install-office-on-wvd-master-image#install-onedrive-in-per-machine-mode",
"services": [
- "Storage",
- "AVD"
+ "AVD",
+ "Storage"
],
"severity": "Low",
"subcategory": "Golden Images",
@@ -15842,9 +19394,9 @@
"guid": "90083845-c587-4cb3-a1ec-16a1d076ef9f",
"link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share",
"services": [
+ "AVD",
"Storage",
- "Cost",
- "AVD"
+ "Cost"
],
"severity": "Medium",
"subcategory": "MSIX & AppAttach",
@@ -15872,10 +19424,10 @@
"guid": "66e15d4d-5a2a-4db2-a3e2-326bf225ca41",
"link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share",
"services": [
+ "AVD",
"RBAC",
"Storage",
- "VM",
- "AVD"
+ "VM"
],
"severity": "Medium",
"subcategory": "MSIX & AppAttach",
@@ -15931,8 +19483,8 @@
"guid": "e4633254-3185-40a1-b120-bd563a1c8e9d",
"link": "https://docs.microsoft.com/azure/virtual-machines/generation-2",
"services": [
- "VM",
- "AVD"
+ "AVD",
+ "VM"
],
"severity": "Medium",
"subcategory": "Session Host",
@@ -15960,8 +19512,8 @@
"guid": "8468c55a-775c-46ee-a5b8-6ad8844ce3b2",
"link": "https://learn.microsoft.com/azure/virtual-desktop/terminology#host-pools",
"services": [
- "VM",
- "AVD"
+ "AVD",
+ "VM"
],
"severity": "High",
"subcategory": "Capacity Planning",
@@ -15975,8 +19527,8 @@
"guid": "4e98495f-d3c0-4af2-aa59-a793395a32a7",
"link": "https://learn.microsoft.com/azure/virtual-desktop/terminology?WT.mc_id=Portal-fx#host-pools",
"services": [
- "VM",
- "AVD"
+ "AVD",
+ "VM"
],
"severity": "High",
"subcategory": "Capacity Planning",
@@ -16018,8 +19570,8 @@
"guid": "b3724959-4943-4577-a3a9-e10ff6345f24",
"link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs",
"services": [
- "VM",
- "AVD"
+ "AVD",
+ "VM"
],
"severity": "Medium",
"subcategory": "Capacity Planning",
@@ -16033,8 +19585,8 @@
"guid": "b384b7ed-1cdd-457e-a2cd-c8d4d55bc144",
"link": "https://learn.microsoft.com/azure/virtual-desktop/terminology?WT.mc_id=Portal-fx#application-groups",
"services": [
- "Storage",
- "AVD"
+ "AVD",
+ "Storage"
],
"severity": "High",
"subcategory": "Capacity Planning",
@@ -16048,9 +19600,9 @@
"guid": "971cc4a4-b1f7-4c12-90e0-1ad96808f00c",
"link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#azure-virtual-desktop-service-limits",
"services": [
- "Entra",
"AVD",
- "ACR"
+ "ACR",
+ "Entra"
],
"severity": "Medium",
"subcategory": "Capacity Planning",
@@ -16078,9 +19630,9 @@
"guid": "38b19ab6-0693-4992-9394-5590883916ec",
"link": "https://learn.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type?tabs=azure#reassign-a-personal-desktop",
"services": [
+ "AVD",
"Storage",
- "VM",
- "AVD"
+ "VM"
],
"severity": "Low",
"subcategory": "Capacity Planning",
@@ -16094,8 +19646,8 @@
"guid": "e1112dbd-7ba0-412e-9b94-ef6e047d2ea2",
"link": "https://docs.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs",
"services": [
- "VM",
- "AVD"
+ "AVD",
+ "VM"
],
"severity": "High",
"subcategory": "Capacity Planning",
@@ -16109,8 +19661,8 @@
"guid": "992b1cd6-d2f5-44b2-a769-e3a691e8838a",
"link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop#considerations",
"services": [
- "Storage",
- "AVD"
+ "AVD",
+ "Storage"
],
"severity": "High",
"subcategory": "Capacity Planning",
@@ -16138,8 +19690,8 @@
"guid": "b47a393a-0803-4272-a479-8b1578b219a4",
"link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
"services": [
- "VM",
- "AVD"
+ "AVD",
+ "VM"
],
"severity": "Low",
"subcategory": "Capacity Planning",
@@ -16167,10 +19719,10 @@
"guid": "6abca2a4-fda1-4dbf-9dc9-5d48c7c791dc",
"link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop?toc=%2Fazure%2Fvirtual-desktop%2Ftoc.json&bc=%2Fazure%2Fvirtual-desktop%2Fbreadcrumb%2Ftoc.json",
"services": [
- "VPN",
- "Storage",
"AVD",
- "ExpressRoute"
+ "Storage",
+ "ExpressRoute",
+ "VPN"
],
"severity": "Medium",
"subcategory": "Clients & Users",
@@ -16254,9 +19806,9 @@
"guid": "8053d89e-89dc-47b3-9be2-a1a27f7a9e91",
"link": "https://docs.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
"services": [
+ "AVD",
"Storage",
- "VM",
- "AVD"
+ "VM"
],
"severity": "Low",
"subcategory": "General",
@@ -16270,10 +19822,10 @@
"guid": "c14aea7e-65e8-4d9a-9aec-218e6436b073",
"link": "https://docs.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
"services": [
- "Entra",
+ "AVD",
"Storage",
"VNet",
- "AVD"
+ "Entra"
],
"severity": "Medium",
"subcategory": "Active Directory",
@@ -16287,8 +19839,8 @@
"guid": "6db55f57-9603-4334-adf9-cc23418db612",
"link": "https://docs.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
"services": [
- "Entra",
- "AVD"
+ "AVD",
+ "Entra"
],
"severity": "Medium",
"subcategory": "Active Directory",
@@ -16302,8 +19854,8 @@
"guid": "7126504b-b47a-4393-a080-327294798b15",
"link": "https://docs.microsoft.com/previous-versions/windows/desktop/Policy/group-policy-hierarchy",
"services": [
- "Entra",
- "AVD"
+ "AVD",
+ "Entra"
],
"severity": "Medium",
"subcategory": "Active Directory",
@@ -16317,8 +19869,8 @@
"guid": "2226a8e3-50a4-4ac3-8bd6-ee150553051f",
"link": "https://learn.microsoft.com/fslogix/how-to-use-group-policy-templates",
"services": [
- "Entra",
- "AVD"
+ "AVD",
+ "Entra"
],
"severity": "Medium",
"subcategory": "Active Directory",
@@ -16332,9 +19884,9 @@
"guid": "347dc560-28a7-41ff-b1cd-15dd2f0d5e77",
"link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#session-hosts",
"services": [
- "Entra",
+ "AVD",
"VM",
- "AVD"
+ "Entra"
],
"severity": "Medium",
"subcategory": "Active Directory",
@@ -16348,8 +19900,8 @@
"guid": "2d41e361-1cc5-47b4-a4b1-410d43958a8c",
"link": "https://docs.microsoft.com/azure/virtual-desktop/manage-app-groups",
"services": [
- "Entra",
- "AVD"
+ "AVD",
+ "Entra"
],
"severity": "Medium",
"subcategory": "Active Directory",
@@ -16363,10 +19915,10 @@
"guid": "2289b3d6-b57c-4fc6-9546-1e1a3e3453a3",
"link": "https://docs.microsoft.com/azure/storage/files/storage-files-identity-ad-ds-enable",
"services": [
- "Entra",
- "Storage",
"AVD",
- "AzurePolicy"
+ "Storage",
+ "AzurePolicy",
+ "Entra"
],
"severity": "High",
"subcategory": "Active Directory",
@@ -16380,8 +19932,8 @@
"guid": "5119bf8e-8f58-4542-a7d9-cec166cd072a",
"link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#identity",
"services": [
- "Entra",
- "AVD"
+ "AVD",
+ "Entra"
],
"severity": "High",
"subcategory": "Active Directory",
@@ -16395,9 +19947,9 @@
"guid": "e777fd5e-c5f1-4d6e-8fa9-fc210b88e338",
"link": "https://learn.microsoft.com/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable",
"services": [
- "Entra",
+ "AVD",
"Storage",
- "AVD"
+ "Entra"
],
"severity": "Medium",
"subcategory": "Microsoft Entra ID",
@@ -16411,10 +19963,10 @@
"guid": "6ceb5443-5125-4922-9442-93bb628537a5",
"link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#identity",
"services": [
- "Entra",
- "VNet",
"AVD",
- "Subscriptions"
+ "VNet",
+ "Subscriptions",
+ "Entra"
],
"severity": "High",
"subcategory": "Requirements",
@@ -16428,8 +19980,8 @@
"guid": "b4ce4781-7557-4a1f-8043-332ae199d44c",
"link": "https://learn.microsoft.com/azure/virtual-desktop/authentication",
"services": [
- "Entra",
- "AVD"
+ "AVD",
+ "Entra"
],
"severity": "High",
"subcategory": "Requirements",
@@ -16443,8 +19995,8 @@
"guid": "f9b141a8-98a5-435e-9378-97e71ca7da7b",
"link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios",
"services": [
- "Entra",
- "AVD"
+ "AVD",
+ "Entra"
],
"severity": "Medium",
"subcategory": "Requirements",
@@ -16458,8 +20010,8 @@
"guid": "5f9f680a-ba07-4429-bbf7-93d7071561f4",
"link": "https://learn.microsoft.com/azure/virtual-desktop/authentication#single-sign-on-sso",
"services": [
- "Entra",
- "AVD"
+ "AVD",
+ "Entra"
],
"severity": "Medium",
"subcategory": "Requirements",
@@ -16473,9 +20025,9 @@
"guid": "ea962a15-9394-46da-a7cc-3923266b2258",
"link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios",
"services": [
- "Entra",
+ "AVD",
"VM",
- "AVD"
+ "Entra"
],
"severity": "High",
"subcategory": "Requirements",
@@ -16489,8 +20041,8 @@
"guid": "6f4a1651-bddd-4ea8-a487-cdeb4861bc3b",
"link": "https://docs.microsoft.com/azure/active-directory-domain-services/compare-identity-solutions",
"services": [
- "Entra",
- "AVD"
+ "AVD",
+ "Entra"
],
"severity": "Low",
"subcategory": "Requirements",
@@ -16504,9 +20056,9 @@
"guid": "5549524b-36c0-4f1a-892b-ab3ca78f5db2",
"link": "https://learn.microsoft.com/azure/virtual-desktop/administrative-template",
"services": [
- "Entra",
"AVD",
- "Monitor"
+ "Monitor",
+ "Entra"
],
"severity": "Low",
"subcategory": "Management",
@@ -16520,8 +20072,8 @@
"guid": "3334fdf9-1c23-4418-8b65-285269440b4b",
"link": "https://learn.microsoft.com/azure/virtual-desktop/management",
"services": [
- "VM",
"AVD",
+ "VM",
"Monitor"
],
"severity": "Low",
@@ -16551,9 +20103,9 @@
"guid": "7138b820-102c-4e16-be30-1e6e872e52e3",
"link": "https://learn.microsoft.com/azure/virtual-desktop/autoscale-scenarios",
"services": [
- "VM",
"AVD",
"Cost",
+ "VM",
"Monitor"
],
"severity": "Medium",
@@ -16568,9 +20120,9 @@
"guid": "55f612fe-f215-4f0d-a956-10e7dd96bcbc",
"link": "https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect",
"services": [
- "VM",
"AVD",
"Cost",
+ "VM",
"Monitor"
],
"severity": "Low",
@@ -16585,10 +20137,10 @@
"guid": "79a686ea-d971-4ea0-a9a8-1aea074c94cb",
"link": "https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect-faq#are-vms-automatically-deallocated-when-a-user-stops-using-them",
"services": [
- "VM",
- "AVD",
- "AzurePolicy",
"Monitor",
+ "AzurePolicy",
+ "AVD",
+ "VM",
"Cost"
],
"severity": "Low",
@@ -16603,13 +20155,13 @@
"guid": "51bcafca-476a-48fa-9b91-9645a7679f20",
"link": "https://learn.microsoft.com/azure/virtual-desktop/tag-virtual-desktop-resources",
"services": [
+ "Monitor",
"Storage",
- "DNS",
"AVD",
- "VPN",
- "Monitor",
- "Cost",
"ExpressRoute",
+ "DNS",
+ "Cost",
+ "VPN",
"VWAN"
],
"severity": "Low",
@@ -16624,10 +20176,10 @@
"guid": "611dd68c-5a4b-4252-8e44-a59a9c2399c4",
"link": "https://learn.microsoft.com/azure/virtual-desktop/azure-advisor-recommendations",
"services": [
- "Entra",
- "Cost",
"AVD",
- "Monitor"
+ "Cost",
+ "Monitor",
+ "Entra"
],
"severity": "Low",
"subcategory": "Management",
@@ -16671,8 +20223,8 @@
"guid": "d1e8c38e-c936-4667-913c-005674b1e944",
"link": "https://docs.microsoft.com/azure/virtual-desktop/create-validation-host-pool",
"services": [
- "VM",
"AVD",
+ "VM",
"Monitor"
],
"severity": "Medium",
@@ -16687,8 +20239,8 @@
"guid": "a459c373-e7ed-4616-83b3-65a917ecbe48",
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/wvd/eslz-platform-automation-and-devops",
"services": [
- "VM",
"AVD",
+ "VM",
"Monitor"
],
"severity": "Medium",
@@ -16703,8 +20255,8 @@
"guid": "ebe54cd7-df2e-48bb-ac35-81559bb9153e",
"link": "https://docs.microsoft.com/azure/virtual-desktop/faq",
"services": [
- "VM",
"AVD",
+ "VM",
"Monitor"
],
"severity": "Medium",
@@ -16734,8 +20286,8 @@
"guid": "81770afb-c4c0-4e43-a186-58d2857ed671",
"link": "https://docs.microsoft.com/azure/virtual-desktop/diagnostics-log-analytics",
"services": [
- "VM",
"AVD",
+ "VM",
"Monitor"
],
"severity": "Medium",
@@ -16750,8 +20302,8 @@
"guid": "2463cffe-179c-4599-be0d-5973dd4ce32c",
"link": "https://docs.microsoft.com/azure/storage/files/storage-files-monitoring?tabs=azure-portal",
"services": [
- "Storage",
"AVD",
+ "Storage",
"Monitor"
],
"severity": "Medium",
@@ -16781,10 +20333,10 @@
"guid": "dd399cfd-7b28-4dc8-9555-6202bfe4563b",
"link": "https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
"services": [
- "VPN",
"AVD",
- "NVA",
- "ExpressRoute"
+ "ExpressRoute",
+ "VPN",
+ "NVA"
],
"severity": "Medium",
"subcategory": "Networking",
@@ -16798,8 +20350,8 @@
"guid": "c8639648-a652-4d6c-85e5-02965388e5de",
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/wvd/eslz-network-topology-and-connectivity",
"services": [
- "VNet",
"AVD",
+ "VNet",
"VWAN"
],
"severity": "Medium",
@@ -16814,8 +20366,8 @@
"guid": "d227dd14-2b06-4c21-a799-9a646f4389a7",
"link": "https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
"services": [
- "VPN",
- "AVD"
+ "AVD",
+ "VPN"
],
"severity": "Medium",
"subcategory": "Networking",
@@ -16829,9 +20381,9 @@
"guid": "fc4972cd-3cd2-41bf-9703-6e5e6b4bed3d",
"link": "https://docs.microsoft.com/azure/firewall/protect-windows-virtual-desktop",
"services": [
- "VNet",
"AVD",
"NVA",
+ "VNet",
"Firewall"
],
"severity": "Medium",
@@ -16875,9 +20427,9 @@
"guid": "523181a9-4174-4158-93ff-7ae7c6d37431",
"link": "https://docs.microsoft.com/azure/firewall/protect-windows-virtual-desktop",
"services": [
- "VNet",
"AVD",
"NVA",
+ "VNet",
"Firewall"
],
"severity": "Low",
@@ -16892,8 +20444,8 @@
"guid": "cc6edca0-aeca-4566-9e92-cf246f1465af",
"link": "https://learn.microsoft.com/azure/virtual-desktop/proxy-server-support",
"services": [
- "VM",
- "AVD"
+ "AVD",
+ "VM"
],
"severity": "High",
"subcategory": "Networking",
@@ -16907,8 +20459,8 @@
"guid": "516785c6-fa96-4c96-ad88-408f372734c8",
"link": "https://learn.microsoft.com/azure/virtual-desktop/rdp-bandwidth",
"services": [
- "VM",
- "AVD"
+ "AVD",
+ "VM"
],
"severity": "Low",
"subcategory": "Networking",
@@ -16922,10 +20474,10 @@
"guid": "ec27d589-9178-426d-8df2-ff60020f30a6",
"link": "https://learn.microsoft.com/azure/storage/files/storage-files-networking-endpoints",
"services": [
- "PrivateLink",
"Storage",
- "AVD",
"VNet",
+ "PrivateLink",
+ "AVD",
"Cost"
],
"severity": "Medium",
@@ -16940,8 +20492,8 @@
"guid": "b2074747-d01a-4f61-b1aa-92ad793d9ff4",
"link": "https://docs.microsoft.com/azure/virtual-desktop/shortpath",
"services": [
- "VPN",
- "AVD"
+ "AVD",
+ "VPN"
],
"severity": "Medium",
"subcategory": "Networking",
@@ -16984,10 +20536,10 @@
"guid": "0fd32907-98bc-4178-adc5-a06ca7144351",
"link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview",
"services": [
- "AKV",
+ "AVD",
"Storage",
"VM",
- "AVD"
+ "AKV"
],
"severity": "Low",
"subcategory": "Host Configuration",
@@ -17001,8 +20553,8 @@
"guid": "36a5a67f-bb9e-4d5b-9547-8c4479816b28",
"link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#azure-virtual-desktop-support-for-trusted-launch",
"services": [
- "VM",
"AVD",
+ "VM",
"Monitor"
],
"severity": "Medium",
@@ -17017,8 +20569,8 @@
"guid": "135d3899-4b31-44d3-bc8f-028871a359d8",
"link": "https://learn.microsoft.com/windows/whats-new/windows-11-requirements",
"services": [
- "VM",
- "AVD"
+ "AVD",
+ "VM"
],
"severity": "High",
"subcategory": "Host Configuration",
@@ -17103,12 +20655,12 @@
"guid": "1814387e-5ca9-4c26-a9b3-2ab5bdfc6998",
"link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#enable-microsoft-defender-for-cloud",
"services": [
- "AKV",
"Storage",
- "Defender",
- "VM",
+ "AKV",
+ "Subscriptions",
"AVD",
- "Subscriptions"
+ "VM",
+ "Defender"
],
"severity": "Medium",
"subcategory": "Management",
@@ -17122,9 +20674,9 @@
"guid": "a0916a76-4980-4ad0-b278-ee293c1bc352",
"link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#collect-audit-logs",
"services": [
- "Entra",
"AVD",
- "Monitor"
+ "Monitor",
+ "Entra"
],
"severity": "Medium",
"subcategory": "Management",
@@ -17138,9 +20690,9 @@
"guid": "baaab757-1849-4ab8-893d-c9fc9d1bb73b",
"link": "https://docs.microsoft.com/azure/virtual-desktop/rbac",
"services": [
- "Entra",
+ "AVD",
"RBAC",
- "AVD"
+ "Entra"
],
"severity": "Low",
"subcategory": "Management",
@@ -17169,8 +20721,8 @@
"guid": "916d697d-8ead-4ed2-9bdd-186f1ac252b9",
"link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-mfa",
"services": [
- "Entra",
- "AVD"
+ "AVD",
+ "Entra"
],
"severity": "Medium",
"subcategory": "Microsoft Entra ID",
@@ -17198,8 +20750,8 @@
"guid": "9164e990-9ae2-48c8-9c33-b6b7808bafe6",
"link": "https://learn.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files#best-practices-for-azure-virtual-desktop",
"services": [
- "Storage",
- "AVD"
+ "AVD",
+ "Storage"
],
"severity": "Medium",
"subcategory": "Azure Files",
@@ -17213,10 +20765,10 @@
"guid": "5784b6ca-5e9e-4bcf-8b54-c95459ea7369",
"link": "https://learn.microsoft.com/azure/storage/files/storage-files-smb-multichannel-performance",
"services": [
- "Storage",
- "Cost",
"AVD",
- "ACR"
+ "Storage",
+ "ACR",
+ "Cost"
],
"severity": "Low",
"subcategory": "Azure Files",
@@ -17230,8 +20782,8 @@
"guid": "4a359836-ee79-4d6c-9d3a-364a5b7abae3",
"link": "https://azure.microsoft.com/global-infrastructure/services/",
"services": [
- "Storage",
- "AVD"
+ "AVD",
+ "Storage"
],
"severity": "Medium",
"subcategory": "Azure NetApp Files",
@@ -17245,8 +20797,8 @@
"guid": "a2661898-866a-4c8d-9d1f-8cfc86e88024",
"link": "https://learn.microsoft.com/azure/virtual-desktop/create-fslogix-profile-container",
"services": [
- "Storage",
- "AVD"
+ "AVD",
+ "Storage"
],
"severity": "Medium",
"subcategory": "Azure NetApp Files",
@@ -17260,9 +20812,9 @@
"guid": "6647e977-db49-48a8-bc35-743f17499d42",
"link": "https://docs.microsoft.com/azure/azure-netapp-files/create-active-directory-connections",
"services": [
+ "AVD",
"Storage",
- "VNet",
- "AVD"
+ "VNet"
],
"severity": "High",
"subcategory": "Azure NetApp Files",
@@ -17276,8 +20828,8 @@
"guid": "3611c818-b0a0-4bc5-80e4-3a18a9cd289c",
"link": "https://docs.microsoft.com/azure/virtual-machines/disks-types",
"services": [
- "Storage",
- "AVD"
+ "AVD",
+ "Storage"
],
"severity": "Medium",
"subcategory": "Capacity Planning",
@@ -17291,9 +20843,9 @@
"guid": "ed6b17db-8255-4462-b2ae-e4553afc8339",
"link": "https://docs.microsoft.com/azure/virtual-desktop/store-fslogix-profile",
"services": [
+ "AVD",
"Storage",
- "VM",
- "AVD"
+ "VM"
],
"severity": "High",
"subcategory": "Capacity Planning",
@@ -17307,8 +20859,8 @@
"guid": "2fad62bd-5004-453c-ace4-64d862e7f5a4",
"link": "https://learn.microsoft.com/azure/virtual-desktop/store-fslogix-profile",
"services": [
- "Storage",
- "AVD"
+ "AVD",
+ "Storage"
],
"severity": "High",
"subcategory": "Capacity Planning",
@@ -17322,8 +20874,8 @@
"guid": "680e7828-9c93-4665-9d02-bff4564b0d93",
"link": "https://learn.microsoft.com/azure/virtual-desktop/faq#what-s-the-largest-profile-size-fslogix-can-handle-",
"services": [
- "Storage",
- "AVD"
+ "AVD",
+ "Storage"
],
"severity": "High",
"subcategory": "Capacity Planning",
@@ -17337,9 +20889,9 @@
"guid": "8aad53cc-79e2-4e86-9673-57c549675c5e",
"link": "https://docs.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files",
"services": [
+ "AVD",
"Storage",
- "Cost",
- "AVD"
+ "Cost"
],
"severity": "High",
"subcategory": "Capacity Planning",
@@ -17353,9 +20905,9 @@
"guid": "df47d2d9-2881-4b1c-b5d1-e54a29759e39",
"link": "https://learn.microsoft.com/fslogix/concepts-container-types#when-to-use-profile-and-odfc-containers",
"services": [
+ "AVD",
"Storage",
- "ASR",
- "AVD"
+ "ASR"
],
"severity": "High",
"subcategory": "FSLogix",
@@ -17369,8 +20921,8 @@
"guid": "83f63047-22ee-479d-9b5c-3632054b69ba",
"link": "https://learn.microsoft.com/fslogix/overview-prerequisites#configure-antivirus-file-and-folder-exclusions",
"services": [
- "Storage",
- "AVD"
+ "AVD",
+ "Storage"
],
"severity": "Medium",
"subcategory": "FSLogix",
@@ -17384,8 +20936,8 @@
"guid": "01e6a84d-e5df-443d-8992-481718d5d1e5",
"link": "https://docs.microsoft.com/fslogix/profile-container-configuration-reference",
"services": [
- "Storage",
- "AVD"
+ "AVD",
+ "Storage"
],
"severity": "High",
"subcategory": "FSLogix",
@@ -17399,10 +20951,10 @@
"guid": "d34aad5e-8c78-4e1d-9666-7313c405674c",
"link": "https://learn.microsoft.com/fslogix/concepts-configuration-examples",
"services": [
- "AKV",
- "Storage",
"AVD",
- "ACR"
+ "Storage",
+ "ACR",
+ "AKV"
],
"severity": "High",
"subcategory": "FSLogix",
@@ -17416,8 +20968,8 @@
"guid": "5e985b85-9c77-43e7-b261-623b775a917e",
"link": "https://learn.microsoft.com/fslogix/concepts-multi-concurrent-connections",
"services": [
- "Storage",
- "AVD"
+ "AVD",
+ "Storage"
],
"severity": "High",
"subcategory": "FSLogix",
@@ -17431,9 +20983,9 @@
"guid": "b2d1215a-e114-4ba3-9df5-85ecdcd9bd3b",
"link": "https://docs.microsoft.com/fslogix/cloud-cache-configuration-reference",
"services": [
+ "AVD",
"Storage",
- "VM",
- "AVD"
+ "VM"
],
"severity": "Low",
"subcategory": "FSLogix",
@@ -17447,8 +20999,8 @@
"guid": "0b50ca97-b1d2-473c-b4d9-6e98b0f912de",
"link": "https://docs.microsoft.com/fslogix/manage-profile-content-cncpt#redirectionsxml",
"services": [
- "Storage",
- "AVD"
+ "AVD",
+ "Storage"
],
"severity": "Medium",
"subcategory": "FSLogix",
@@ -17632,8 +21184,8 @@
"link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions",
"service": "CosmosDB",
"services": [
- "CosmosDB",
- "ACR"
+ "ACR",
+ "CosmosDB"
],
"severity": "Medium",
"subcategory": "High Availability",
@@ -17648,8 +21200,8 @@
"link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
"service": "CosmosDB",
"services": [
- "CosmosDB",
- "ACR"
+ "ACR",
+ "CosmosDB"
],
"severity": "Medium",
"subcategory": "High Availability",
@@ -17694,9 +21246,9 @@
"link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore",
"service": "CosmosDB",
"services": [
- "Backup",
+ "Storage",
"CosmosDB",
- "Storage"
+ "Backup"
],
"severity": "Medium",
"subcategory": "Backup Strategy",
@@ -17712,8 +21264,8 @@
"link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction",
"service": "CosmosDB",
"services": [
- "Backup",
- "CosmosDB"
+ "CosmosDB",
+ "Backup"
],
"severity": "Medium",
"subcategory": "Backup Strategy",
@@ -17729,8 +21281,8 @@
"link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction",
"service": "CosmosDB",
"services": [
- "Backup",
- "CosmosDB"
+ "CosmosDB",
+ "Backup"
],
"severity": "Medium",
"subcategory": "Backup Strategy",
@@ -17775,9 +21327,9 @@
"link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
"service": "SAP",
"services": [
+ "SAP",
"Backup",
- "ASR",
- "SAP"
+ "ASR"
],
"severity": "Medium",
"subcategory": "Backup and restore",
@@ -17790,9 +21342,9 @@
"guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
"service": "SAP",
"services": [
- "Backup",
+ "SAP",
"ASR",
- "SAP"
+ "Backup"
],
"severity": "Medium",
"subcategory": "Disaster recovery",
@@ -17806,11 +21358,11 @@
"link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
"service": "SAP",
"services": [
- "Backup",
- "SQL",
"Storage",
"ASR",
- "SAP"
+ "Backup",
+ "SAP",
+ "SQL"
],
"severity": "High",
"subcategory": "Disaster recovery",
@@ -17825,8 +21377,8 @@
"link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
"service": "SAP",
"services": [
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "Medium",
"subcategory": "Disaster recovery",
@@ -17841,10 +21393,10 @@
"link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
"service": "SAP",
"services": [
- "VPN",
- "ASR",
+ "SAP",
"ExpressRoute",
- "SAP"
+ "VPN",
+ "ASR"
],
"severity": "High",
"subcategory": "Disaster recovery",
@@ -17859,10 +21411,10 @@
"link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
"service": "SAP",
"services": [
- "AKV",
+ "SAP",
"ACR",
- "ASR",
- "SAP"
+ "AKV",
+ "ASR"
],
"severity": "Low",
"subcategory": "Disaster recovery",
@@ -17876,9 +21428,9 @@
"link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
"service": "SAP",
"services": [
+ "SAP",
"VNet",
- "ASR",
- "SAP"
+ "ASR"
],
"severity": "Medium",
"subcategory": "Disaster recovery",
@@ -17893,8 +21445,8 @@
"service": "SAP",
"services": [
"Storage",
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "Low",
"subcategory": "Disaster recovery",
@@ -17909,8 +21461,8 @@
"link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
"service": "SAP",
"services": [
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "High",
"subcategory": "Disaster recovery",
@@ -17925,9 +21477,9 @@
"link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
"service": "SAP",
"services": [
- "ASR",
+ "SAP",
"VNet",
- "SAP"
+ "ASR"
],
"severity": "High",
"subcategory": "Disaster recovery",
@@ -17941,10 +21493,10 @@
"guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
"service": "SAP",
"services": [
- "Entra",
- "ASR",
"VM",
- "SAP"
+ "SAP",
+ "Entra",
+ "ASR"
],
"severity": "High",
"subcategory": "Disaster recovery",
@@ -17959,8 +21511,8 @@
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
"service": "SAP",
"services": [
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "High",
"subcategory": "High availability",
@@ -17975,8 +21527,8 @@
"link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
"service": "SAP",
"services": [
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "High",
"subcategory": "High availability",
@@ -17991,10 +21543,10 @@
"link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
"service": "SAP",
"services": [
- "Storage",
"VM",
- "ASR",
- "SAP"
+ "Storage",
+ "SAP",
+ "ASR"
],
"severity": "High",
"subcategory": "High availability",
@@ -18010,8 +21562,8 @@
"service": "SAP",
"services": [
"Storage",
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "High",
"subcategory": "High availability",
@@ -18026,8 +21578,8 @@
"link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
"service": "SAP",
"services": [
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "High",
"subcategory": "High availability",
@@ -18042,9 +21594,9 @@
"link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
"service": "SAP",
"services": [
+ "SAP",
"LoadBalancer",
- "ASR",
- "SAP"
+ "ASR"
],
"severity": "High",
"subcategory": "High availability",
@@ -18059,9 +21611,9 @@
"link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
"service": "SAP",
"services": [
+ "SAP",
"LoadBalancer",
- "ASR",
- "SAP"
+ "ASR"
],
"severity": "High",
"subcategory": "High availability",
@@ -18076,8 +21628,8 @@
"link": "https://learn.microsoft.com/azure/virtual-machines/availability",
"service": "SAP",
"services": [
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "High",
"subcategory": "High availability",
@@ -18092,10 +21644,10 @@
"link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
"service": "SAP",
"services": [
- "Entra",
- "ASR",
"VM",
- "SAP"
+ "SAP",
+ "Entra",
+ "ASR"
],
"severity": "High",
"subcategory": "High availability",
@@ -18110,9 +21662,9 @@
"service": "SAP",
"services": [
"Entra",
- "ASR",
"VM",
"RBAC",
+ "ASR",
"SAP"
],
"severity": "High",
@@ -18128,8 +21680,8 @@
"link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
"service": "SAP",
"services": [
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "Medium",
"subcategory": "High availability",
@@ -18144,9 +21696,9 @@
"link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
"service": "SAP",
"services": [
- "ASR",
"VM",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "High",
"subcategory": "High availability",
@@ -18162,8 +21714,8 @@
"service": "SAP",
"services": [
"Entra",
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "High",
"subcategory": "High availability",
@@ -18177,9 +21729,9 @@
"link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
"service": "SAP",
"services": [
+ "SAP",
"ACR",
- "ASR",
- "SAP"
+ "ASR"
],
"severity": "High",
"subcategory": "High availability",
@@ -18194,8 +21746,8 @@
"service": "SAP",
"services": [
"Entra",
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "High",
"subcategory": "High availability",
@@ -18210,10 +21762,10 @@
"link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
"service": "SAP",
"services": [
- "Entra",
- "ASR",
"VM",
- "SAP"
+ "SAP",
+ "Entra",
+ "ASR"
],
"severity": "Medium",
"subcategory": "High availability",
@@ -18228,10 +21780,10 @@
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
"service": "SAP",
"services": [
- "Storage",
"VM",
- "ASR",
- "SAP"
+ "Storage",
+ "SAP",
+ "ASR"
],
"severity": "Medium",
"subcategory": "High availability",
@@ -18245,8 +21797,8 @@
"link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
"service": "SAP",
"services": [
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "Medium",
"subcategory": "High availability",
@@ -18262,8 +21814,8 @@
"service": "SAP",
"services": [
"Storage",
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "High",
"subcategory": "Storage",
@@ -18279,8 +21831,8 @@
"service": "SAP",
"services": [
"Storage",
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "High",
"subcategory": "Storage",
@@ -18296,8 +21848,8 @@
"service": "SAP",
"services": [
"Storage",
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "High",
"subcategory": "Storage",
@@ -18313,8 +21865,8 @@
"service": "SAP",
"services": [
"Storage",
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "High",
"subcategory": "Storage",
@@ -18328,8 +21880,8 @@
"link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
"service": "SAP",
"services": [
- "Cost",
- "SAP"
+ "SAP",
+ "Cost"
],
"severity": "Medium",
"subcategory": " ",
@@ -18343,10 +21895,10 @@
"link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
"service": "SAP",
"services": [
- "Storage",
"VM",
- "Cost",
- "SAP"
+ "Storage",
+ "SAP",
+ "Cost"
],
"severity": "Low",
"subcategory": " ",
@@ -18360,10 +21912,10 @@
"link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
"service": "SAP",
"services": [
- "Storage",
"VM",
- "Cost",
- "SAP"
+ "Storage",
+ "SAP",
+ "Cost"
],
"severity": "Low",
"subcategory": " ",
@@ -18379,8 +21931,8 @@
"services": [
"Entra",
"RBAC",
- "Subscriptions",
- "SAP"
+ "SAP",
+ "Subscriptions"
],
"severity": "High",
"subcategory": "Identity",
@@ -18473,8 +22025,8 @@
"service": "SAP",
"services": [
"Entra",
- "AKV",
- "SAP"
+ "SAP",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Identity",
@@ -18490,8 +22042,8 @@
"service": "SAP",
"services": [
"Entra",
- "AKV",
- "SAP"
+ "SAP",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Identity",
@@ -18610,9 +22162,9 @@
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
"service": "SAP",
"services": [
- "Subscriptions",
+ "SAP",
"AzurePolicy",
- "SAP"
+ "Subscriptions"
],
"severity": "Medium",
"subcategory": "Subscriptions",
@@ -18627,8 +22179,8 @@
"link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
"service": "SAP",
"services": [
- "Subscriptions",
- "SAP"
+ "SAP",
+ "Subscriptions"
],
"severity": "High",
"subcategory": "Subscriptions",
@@ -18643,8 +22195,8 @@
"link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
"service": "SAP",
"services": [
- "Subscriptions",
- "SAP"
+ "SAP",
+ "Subscriptions"
],
"severity": "High",
"subcategory": "Subscriptions",
@@ -18660,8 +22212,8 @@
"service": "SAP",
"services": [
"VM",
- "Subscriptions",
- "SAP"
+ "SAP",
+ "Subscriptions"
],
"severity": "High",
"subcategory": "Subscriptions",
@@ -18676,8 +22228,8 @@
"link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
"service": "SAP",
"services": [
- "Subscriptions",
- "SAP"
+ "SAP",
+ "Subscriptions"
],
"severity": "Low",
"subcategory": "Subscriptions",
@@ -18692,8 +22244,8 @@
"service": "SAP",
"services": [
"VM",
- "Subscriptions",
- "SAP"
+ "SAP",
+ "Subscriptions"
],
"severity": "High",
"subcategory": "Subscriptions",
@@ -18707,8 +22259,8 @@
"link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
"service": "SAP",
"services": [
- "Subscriptions",
- "SAP"
+ "SAP",
+ "Subscriptions"
],
"severity": "High",
"subcategory": "Subscriptions",
@@ -18723,10 +22275,10 @@
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
"service": "SAP",
"services": [
+ "SAP",
"TrafficManager",
- "Cost",
"Subscriptions",
- "SAP"
+ "Cost"
],
"severity": "Medium",
"subcategory": "Subscriptions",
@@ -18742,8 +22294,8 @@
"service": "SAP",
"services": [
"Monitor",
- "Backup",
- "SAP"
+ "SAP",
+ "Backup"
],
"severity": "High",
"subcategory": "BCDR",
@@ -18758,10 +22310,10 @@
"link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
"service": "SAP",
"services": [
- "Entra",
+ "Monitor",
"Storage",
+ "Entra",
"VM",
- "Monitor",
"SAP"
],
"severity": "Medium",
@@ -18792,8 +22344,8 @@
"service": "SAP",
"services": [
"Entra",
- "Monitor",
- "SAP"
+ "SAP",
+ "Monitor"
],
"severity": "Medium",
"subcategory": "Management",
@@ -18809,8 +22361,8 @@
"service": "SAP",
"services": [
"Monitor",
- "Cost",
- "SAP"
+ "SAP",
+ "Cost"
],
"severity": "Low",
"subcategory": "Management",
@@ -18825,8 +22377,8 @@
"service": "SAP",
"services": [
"Entra",
- "Monitor",
- "SAP"
+ "SAP",
+ "Monitor"
],
"severity": "Medium",
"subcategory": "Management",
@@ -18840,9 +22392,9 @@
"link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
"service": "SAP",
"services": [
- "Monitor",
"VM",
- "SAP"
+ "SAP",
+ "Monitor"
],
"severity": "Medium",
"subcategory": "Management",
@@ -18874,8 +22426,8 @@
"service": "SAP",
"services": [
"Monitor",
- "SQL",
- "SAP"
+ "SAP",
+ "SQL"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -18890,10 +22442,10 @@
"link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
"service": "SAP",
"services": [
- "Entra",
- "Monitor",
"VM",
- "SAP"
+ "SAP",
+ "Monitor",
+ "Entra"
],
"severity": "High",
"subcategory": "Monitoring",
@@ -18909,8 +22461,8 @@
"service": "SAP",
"services": [
"Monitor",
- "AzurePolicy",
- "SAP"
+ "SAP",
+ "AzurePolicy"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -18925,9 +22477,9 @@
"link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
"service": "SAP",
"services": [
- "NetworkWatcher",
"Monitor",
- "SAP"
+ "SAP",
+ "NetworkWatcher"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -18942,9 +22494,9 @@
"link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
"service": "SAP",
"services": [
- "Monitor",
"VM",
- "SAP"
+ "SAP",
+ "Monitor"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -18959,8 +22511,8 @@
"service": "SAP",
"services": [
"Monitor",
- "Subscriptions",
- "SAP"
+ "SAP",
+ "Subscriptions"
],
"severity": "High",
"subcategory": "Monitoring",
@@ -18977,8 +22529,8 @@
"services": [
"Monitor",
"Storage",
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -18993,8 +22545,8 @@
"link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
"service": "SAP",
"services": [
- "Sentinel",
"Monitor",
+ "Sentinel",
"SAP"
],
"severity": "Medium",
@@ -19011,8 +22563,8 @@
"service": "SAP",
"services": [
"Monitor",
- "Cost",
- "SAP"
+ "SAP",
+ "Cost"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -19027,9 +22579,9 @@
"link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
"service": "SAP",
"services": [
- "Monitor",
"VM",
- "SAP"
+ "SAP",
+ "Monitor"
],
"severity": "Low",
"subcategory": "Performance",
@@ -19044,8 +22596,8 @@
"service": "SAP",
"services": [
"Monitor",
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "Medium",
"subcategory": "Performance",
@@ -19109,8 +22661,8 @@
"service": "SAP",
"services": [
"Monitor",
- "SQL",
- "SAP"
+ "SAP",
+ "SQL"
],
"severity": "Medium",
"subcategory": "Performance",
@@ -19126,8 +22678,8 @@
"service": "SAP",
"services": [
"Monitor",
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "High",
"subcategory": "Reliability",
@@ -19142,10 +22694,10 @@
"link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
"service": "SAP",
"services": [
+ "SAP",
"AppGW",
- "WAF",
"AzurePolicy",
- "SAP"
+ "WAF"
],
"severity": "Medium",
"subcategory": "App delivery",
@@ -19160,8 +22712,8 @@
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
"service": "SAP",
"services": [
- "DNS",
"VM",
+ "DNS",
"SAP"
],
"severity": "Medium",
@@ -19178,8 +22730,8 @@
"service": "SAP",
"services": [
"DNS",
- "VNet",
- "SAP"
+ "SAP",
+ "VNet"
],
"severity": "Medium",
"subcategory": "DNS",
@@ -19195,8 +22747,8 @@
"service": "SAP",
"services": [
"ACR",
- "VNet",
- "SAP"
+ "SAP",
+ "VNet"
],
"severity": "Medium",
"subcategory": "Hybrid",
@@ -19211,8 +22763,8 @@
"link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
"service": "SAP",
"services": [
- "NVA",
- "SAP"
+ "SAP",
+ "NVA"
],
"severity": "High",
"subcategory": "Hybrid",
@@ -19227,9 +22779,9 @@
"link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
"service": "SAP",
"services": [
- "VWAN",
+ "SAP",
"ACR",
- "SAP"
+ "VWAN"
],
"severity": "Medium",
"subcategory": "Hybrid",
@@ -19244,9 +22796,9 @@
"link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
"service": "SAP",
"services": [
- "VNet",
+ "SAP",
"NVA",
- "SAP"
+ "VNet"
],
"severity": "Medium",
"subcategory": "Hybrid",
@@ -19261,10 +22813,10 @@
"link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
"service": "SAP",
"services": [
- "VWAN",
- "VNet",
+ "SAP",
"NVA",
- "SAP"
+ "VNet",
+ "VWAN"
],
"severity": "Medium",
"subcategory": "Hybrid",
@@ -19279,9 +22831,9 @@
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
"service": "SAP",
"services": [
- "VNet",
"VM",
- "SAP"
+ "SAP",
+ "VNet"
],
"severity": "High",
"subcategory": "IP plan",
@@ -19296,9 +22848,9 @@
"link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
"service": "SAP",
"services": [
+ "SAP",
"VNet",
- "ASR",
- "SAP"
+ "ASR"
],
"severity": "High",
"subcategory": "IP plan",
@@ -19313,8 +22865,8 @@
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
"service": "SAP",
"services": [
- "VNet",
- "SAP"
+ "SAP",
+ "VNet"
],
"severity": "High",
"subcategory": "IP plan",
@@ -19330,8 +22882,8 @@
"service": "SAP",
"services": [
"Storage",
- "VNet",
- "SAP"
+ "SAP",
+ "VNet"
],
"severity": "Medium",
"subcategory": "IP plan",
@@ -19346,8 +22898,8 @@
"link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
"service": "SAP",
"services": [
- "Firewall",
- "SAP"
+ "SAP",
+ "Firewall"
],
"severity": "Medium",
"subcategory": "Internet",
@@ -19362,9 +22914,9 @@
"link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
"service": "SAP",
"services": [
+ "SAP",
"AppGW",
- "WAF",
- "SAP"
+ "WAF"
],
"severity": "Medium",
"subcategory": "Internet",
@@ -19380,10 +22932,10 @@
"service": "SAP",
"services": [
"AzurePolicy",
- "FrontDoor",
+ "WAF",
"ACR",
- "SAP",
- "WAF"
+ "FrontDoor",
+ "SAP"
],
"severity": "Medium",
"subcategory": "Internet",
@@ -19398,11 +22950,11 @@
"link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
"service": "SAP",
"services": [
- "AppGW",
"AzurePolicy",
+ "AppGW",
+ "WAF",
"FrontDoor",
- "SAP",
- "WAF"
+ "SAP"
],
"severity": "Medium",
"subcategory": "Internet",
@@ -19417,10 +22969,10 @@
"link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
"service": "SAP",
"services": [
- "LoadBalancer",
+ "SAP",
"AppGW",
"WAF",
- "SAP"
+ "LoadBalancer"
],
"severity": "Medium",
"subcategory": "Internet",
@@ -19435,9 +22987,9 @@
"link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
"service": "SAP",
"services": [
- "VWAN",
+ "SAP",
"ACR",
- "SAP"
+ "VWAN"
],
"severity": "Medium",
"subcategory": "Internet",
@@ -19452,12 +23004,12 @@
"link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
"service": "SAP",
"services": [
- "PrivateLink",
- "Backup",
"Storage",
+ "VNet",
+ "PrivateLink",
"ACR",
- "SAP",
- "VNet"
+ "Backup",
+ "SAP"
],
"severity": "Medium",
"subcategory": "Internet",
@@ -19488,8 +23040,8 @@
"link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
"service": "SAP",
"services": [
- "LoadBalancer",
- "SAP"
+ "SAP",
+ "LoadBalancer"
],
"severity": "Medium",
"subcategory": "Segmentation",
@@ -19505,8 +23057,8 @@
"service": "SAP",
"services": [
"VM",
- "VNet",
- "SAP"
+ "SAP",
+ "VNet"
],
"severity": "Medium",
"subcategory": "Segmentation",
@@ -19521,8 +23073,8 @@
"link": "https://me.sap.com/notes/2015553",
"service": "SAP",
"services": [
- "VNet",
- "SAP"
+ "SAP",
+ "VNet"
],
"severity": "High",
"subcategory": "Segmentation",
@@ -19567,9 +23119,9 @@
"link": "https://me.sap.com/notes/2015553",
"service": "SAP",
"services": [
+ "SAP",
"VNet",
- "Cost",
- "SAP"
+ "Cost"
],
"severity": "High",
"subcategory": "Segmentation",
@@ -19584,8 +23136,8 @@
"link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
"service": "SAP",
"services": [
- "LoadBalancer",
- "SAP"
+ "SAP",
+ "LoadBalancer"
],
"severity": "High",
"subcategory": "Segmentation",
@@ -19600,8 +23152,8 @@
"link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
"service": "SAP",
"services": [
- "VNet",
- "SAP"
+ "SAP",
+ "VNet"
],
"severity": "Medium",
"subcategory": "Segmentation",
@@ -19615,9 +23167,9 @@
"link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
"service": "SAP",
"services": [
- "Backup",
"VM",
- "SAP"
+ "SAP",
+ "Backup"
],
"severity": "High",
"subcategory": " ",
@@ -19632,8 +23184,8 @@
"service": "SAP",
"services": [
"Monitor",
- "ASR",
- "SAP"
+ "SAP",
+ "ASR"
],
"severity": "Medium",
"subcategory": " ",
@@ -19662,9 +23214,9 @@
"link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
"service": "SAP",
"services": [
- "Backup",
"VM",
- "SAP"
+ "SAP",
+ "Backup"
],
"severity": "Medium",
"subcategory": " ",
@@ -19679,8 +23231,8 @@
"service": "SAP",
"services": [
"Storage",
- "SQL",
- "SAP"
+ "SAP",
+ "SQL"
],
"severity": "Medium",
"subcategory": " ",
@@ -19694,9 +23246,9 @@
"link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
"service": "SAP",
"services": [
- "Backup",
"VM",
- "SAP"
+ "SAP",
+ "Backup"
],
"severity": "Medium",
"subcategory": " ",
@@ -19767,8 +23319,8 @@
"service": "SAP",
"services": [
"Monitor",
- "SQL",
- "SAP"
+ "SAP",
+ "SQL"
],
"severity": "Medium",
"subcategory": " ",
@@ -19858,8 +23410,8 @@
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
"service": "SAP",
"services": [
- "SQL",
- "SAP"
+ "SAP",
+ "SQL"
],
"severity": "Low",
"subcategory": "Governance",
@@ -19873,8 +23425,8 @@
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
"service": "SAP",
"services": [
- "SQL",
- "SAP"
+ "SAP",
+ "SQL"
],
"severity": "High",
"subcategory": "Governance",
@@ -19889,11 +23441,11 @@
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
"service": "SAP",
"services": [
+ "Storage",
"AKV",
"Backup",
- "SQL",
- "Storage",
- "SAP"
+ "SAP",
+ "SQL"
],
"severity": "High",
"subcategory": "Secrets",
@@ -19908,9 +23460,9 @@
"link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
"service": "SAP",
"services": [
- "AKV",
"Storage",
- "SAP"
+ "SAP",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Secrets",
@@ -19925,8 +23477,8 @@
"link": "https://learn.microsoft.com/azure/key-vault/general/overview",
"service": "SAP",
"services": [
- "AKV",
- "SAP"
+ "SAP",
+ "AKV"
],
"severity": "High",
"subcategory": "Secrets",
@@ -19941,10 +23493,10 @@
"link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
"service": "SAP",
"services": [
- "AKV",
"AzurePolicy",
- "RBAC",
"Subscriptions",
+ "AKV",
+ "RBAC",
"SAP"
],
"severity": "Medium",
@@ -19960,9 +23512,9 @@
"link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
"service": "SAP",
"services": [
- "AKV",
+ "SAP",
"AzurePolicy",
- "SAP"
+ "AKV"
],
"severity": "Medium",
"subcategory": "Secrets",
@@ -19978,9 +23530,9 @@
"service": "SAP",
"services": [
"RBAC",
- "AKV",
+ "SAP",
"AzurePolicy",
- "SAP"
+ "AKV"
],
"severity": "High",
"subcategory": "Secrets",
@@ -19995,10 +23547,10 @@
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
"service": "SAP",
"services": [
- "AKV",
- "Storage",
"Defender",
- "SAP"
+ "Storage",
+ "SAP",
+ "AKV"
],
"severity": "High",
"subcategory": "Secrets",
@@ -20013,10 +23565,10 @@
"link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
"service": "SAP",
"services": [
- "RBAC",
- "AKV",
"Defender",
- "SAP"
+ "RBAC",
+ "SAP",
+ "AKV"
],
"severity": "High",
"subcategory": "Secrets",
@@ -20031,8 +23583,8 @@
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
"service": "SAP",
"services": [
- "AKV",
- "SAP"
+ "SAP",
+ "AKV"
],
"severity": "Low",
"subcategory": "Secrets",
@@ -20047,8 +23599,8 @@
"link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
"service": "SAP",
"services": [
- "AKV",
- "SAP"
+ "SAP",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Secrets",
@@ -20063,8 +23615,8 @@
"link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
"service": "SAP",
"services": [
- "AKV",
- "SAP"
+ "SAP",
+ "AKV"
],
"severity": "High",
"subcategory": "Secrets",
@@ -20079,8 +23631,8 @@
"link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
"service": "SAP",
"services": [
- "AKV",
- "SAP"
+ "SAP",
+ "AKV"
],
"severity": "High",
"subcategory": "Secrets",
@@ -20096,8 +23648,8 @@
"service": "SAP",
"services": [
"RBAC",
- "Subscriptions",
- "SAP"
+ "SAP",
+ "Subscriptions"
],
"severity": "High",
"subcategory": "Security",
@@ -20112,9 +23664,9 @@
"link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
"service": "SAP",
"services": [
- "PrivateLink",
+ "SAP",
"NVA",
- "SAP"
+ "PrivateLink"
],
"severity": "High",
"subcategory": "Security",
@@ -20129,8 +23681,8 @@
"link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
"service": "SAP",
"services": [
- "Storage",
"VM",
+ "Storage",
"SAP"
],
"severity": "Low",
@@ -20162,8 +23714,8 @@
"link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
"service": "SAP",
"services": [
- "VNet",
- "SAP"
+ "SAP",
+ "VNet"
],
"severity": "High",
"subcategory": "Security",
@@ -20178,8 +23730,8 @@
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
"service": "SAP",
"services": [
- "WAF",
- "SAP"
+ "SAP",
+ "WAF"
],
"severity": "Low",
"subcategory": "Security",
@@ -20194,9 +23746,9 @@
"link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
"service": "SAP",
"services": [
- "AKV",
"Monitor",
- "SAP"
+ "SAP",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Security",
@@ -20395,8 +23947,8 @@
"link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad",
"services": [
"Entra",
- "AKV",
- "Arc"
+ "Arc",
+ "AKV"
],
"severity": "Low",
"subcategory": "Access",
@@ -20490,8 +24042,8 @@
"guid": "6ee79d6b-5c2a-4364-a4b6-9bad38aad53c",
"link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment",
"services": [
- "Arc",
- "Monitor"
+ "Monitor",
+ "Arc"
],
"severity": "Medium",
"subcategory": "Management",
@@ -20505,8 +24057,8 @@
"guid": "c78e1d76-6673-457c-9496-74c5ed85b859",
"link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-agent#upgrade-the-agent",
"services": [
- "Arc",
- "Monitor"
+ "Monitor",
+ "Arc"
],
"severity": "High",
"subcategory": "Management",
@@ -20520,9 +24072,9 @@
"guid": "c7733be2-a1a2-47b7-95a9-1be1f388ff39",
"link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-vm-extensions",
"services": [
+ "Monitor",
"Arc",
- "AzurePolicy",
- "Monitor"
+ "AzurePolicy"
],
"severity": "Medium",
"subcategory": "Management",
@@ -20536,8 +24088,8 @@
"guid": "4c2bd463-cbbb-4c86-a195-abb91a4ed90d",
"link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-automatic-vm-extension-upgrade?tabs=azure-portal",
"services": [
- "Arc",
- "Monitor"
+ "Monitor",
+ "Arc"
],
"severity": "High",
"subcategory": "Management",
@@ -20551,8 +24103,8 @@
"guid": "7a927c39-74d1-4102-aac6-aae01e6a84de",
"link": "https://learn.microsoft.com/azure/automanage/automanage-arc",
"services": [
- "Arc",
- "Monitor"
+ "Monitor",
+ "Arc"
],
"severity": "Medium",
"subcategory": "Management",
@@ -20565,8 +24117,8 @@
"guid": "37b6b780-cbaf-4e6c-9658-9d457a927c39",
"link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment#phase-3-manage-and-operate",
"services": [
- "Arc",
- "Monitor"
+ "Monitor",
+ "Arc"
],
"severity": "High",
"subcategory": "Monitoring",
@@ -20579,8 +24131,8 @@
"guid": "74d1102c-ac6a-4ae0-8e6a-84de5df47d2d",
"link": "https://learn.microsoft.com/azure/azure-monitor/agents/log-analytics-agent#data-collected",
"services": [
- "Arc",
- "Monitor"
+ "Monitor",
+ "Arc"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -20593,8 +24145,8 @@
"guid": "92881b1c-d5d1-4e54-a296-59e3958fd782",
"link": "https://learn.microsoft.com/azure/service-health/resource-health-alert-monitor-guide",
"services": [
- "Arc",
- "Monitor"
+ "Monitor",
+ "Arc"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -20607,8 +24159,8 @@
"guid": "89c93555-6d02-4bfe-9564-b0d834a34872",
"link": "https://learn.microsoft.com/azure/azure-arc/servers/learn/tutorial-enable-vm-insights",
"services": [
- "Arc",
- "Monitor"
+ "Monitor",
+ "Arc"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -20621,8 +24173,8 @@
"guid": "5df47d2d-9288-41b1-ad5d-1e54a29659e3",
"link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment#phase-3-manage-and-operate",
"services": [
- "Arc",
- "Monitor"
+ "Monitor",
+ "Arc"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -20636,8 +24188,8 @@
"guid": "ae2cc84c-37b6-4b78-8cba-fe6c46589d45",
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/hybrid/server/best-practices/arc-update-management",
"services": [
- "Arc",
- "Monitor"
+ "Monitor",
+ "Arc"
],
"severity": "Low",
"subcategory": "Security",
@@ -20679,10 +24231,10 @@
"guid": "94174158-33ee-47ad-9c6d-3733165c7acb",
"link": "https://learn.microsoft.com/azure/azure-arc/servers/private-link-security",
"services": [
- "VPN",
"Arc",
- "PrivateLink",
- "ExpressRoute"
+ "ExpressRoute",
+ "VPN",
+ "PrivateLink"
],
"severity": "Medium",
"subcategory": "Networking",
@@ -20738,9 +24290,9 @@
"guid": "a264f9a1-9bf3-49d9-9d44-c7c8919ca1f6",
"link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/hybrid/arc-enabled-servers/eslz-arc-servers-connectivity#define-extensions-connectivity-method",
"services": [
- "PrivateLink",
+ "Monitor",
"Arc",
- "Monitor"
+ "PrivateLink"
],
"severity": "Low",
"subcategory": "Networking",
@@ -20794,8 +24346,8 @@
"guid": "49674c5e-d85b-4859-a773-3be2a1a27b77",
"link": "https://learn.microsoft.com/azure/automation/change-tracking/overview",
"services": [
- "Arc",
- "Monitor"
+ "Monitor",
+ "Arc"
],
"severity": "Medium",
"subcategory": "Monitoring",
@@ -20821,8 +24373,8 @@
"guid": "195abb91-a4ed-490d-ae2c-c84c37b6b780",
"link": "https://learn.microsoft.com/azure/key-vault/general/basic-concepts",
"services": [
- "AKV",
- "Arc"
+ "Arc",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Secrets",
@@ -20837,9 +24389,9 @@
"link": "https://learn.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal#option-2-create-a-new-application-secret",
"services": [
"Entra",
- "AKV",
+ "Storage",
"Arc",
- "Storage"
+ "AKV"
],
"severity": "High",
"subcategory": "Secrets",
@@ -20853,8 +24405,8 @@
"guid": "a1a27b77-5a91-4be1-b388-ff394c2bd463",
"link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#using-disk-encryption",
"services": [
- "AKV",
- "Arc"
+ "Arc",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Secrets",
@@ -20910,8 +24462,8 @@
"guid": "5a91be1f-388f-4f39-9c2b-d463cbbbc868",
"link": "https://learn.microsoft.com/azure/security-center/security-center-get-started",
"services": [
- "Arc",
- "Defender"
+ "Defender",
+ "Arc"
],
"severity": "Medium",
"subcategory": "Security",
@@ -20950,9 +24502,9 @@
"guid": "676f6951-0368-49e9-808d-c33a692c9a64",
"link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-2-encrypt-backup-data",
"services": [
+ "SQL",
"AKV",
- "Backup",
- "SQL"
+ "Backup"
],
"severity": "Medium",
"subcategory": "Azure Key Vault",
@@ -20966,9 +24518,9 @@
"guid": "e2518261-b3bc-4bd1-b331-637fb2df833f",
"link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-1-ensure-regular-automated-backups",
"services": [
- "Backup",
+ "Storage",
"SQL",
- "Storage"
+ "Backup"
],
"severity": "Medium",
"subcategory": "Backup",
@@ -20982,9 +24534,9 @@
"guid": "f8c7cda2-3ed7-43fb-a100-85dcd12a0ee4",
"link": "https://learn.microsoft.com/azure/azure-sql/database/automated-backups-overview?tabs=single-database&view=azuresql#backup-storage-redundancy",
"services": [
- "Backup",
"Storage",
- "SQL"
+ "SQL",
+ "Backup"
],
"severity": "Low",
"subcategory": "Backup",
@@ -21040,9 +24592,9 @@
"guid": "4e52d73f-5d37-428f-b3a2-e6997e835979",
"link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure",
"services": [
+ "Defender",
"EventHubs",
- "SQL",
- "Defender"
+ "SQL"
],
"severity": "High",
"subcategory": "Advanced Threat Protection",
@@ -21056,9 +24608,9 @@
"guid": "dff87489-9edb-4cef-bdda-86e8212b2aa1",
"link": "https://learn.microsoft.com/azure/azure-sql/database/azure-defender-for-sql?view=azuresql#enable-microsoft-defender-for-sql ",
"services": [
- "Subscriptions",
+ "Defender",
"SQL",
- "Defender"
+ "Subscriptions"
],
"severity": "High",
"subcategory": "Defender for Azure SQL",
@@ -21072,8 +24624,8 @@
"guid": "ca342fdf-d25a-4427-b105-fcd50ff8a0ea",
"link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure",
"services": [
- "SQL",
"Defender",
+ "SQL",
"Monitor"
],
"severity": "High",
@@ -21088,8 +24640,8 @@
"guid": "a6101ae7-534c-45ab-86fd-b34c55ea21ca",
"link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-overview",
"services": [
- "SQL",
"Defender",
+ "SQL",
"Monitor"
],
"severity": "High",
@@ -21104,8 +24656,8 @@
"guid": "c8c5f112-1e50-4f77-9264-8195b4cd61ac",
"link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-find?view=azuresql",
"services": [
- "SQL",
- "Defender"
+ "Defender",
+ "SQL"
],
"severity": "High",
"subcategory": "Vulnerability Assessment",
@@ -21133,9 +24685,9 @@
"guid": "c03ce136-e3d5-4e17-bf25-ed955ee480d3",
"link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#control-access-of-application-users-to-sensitive-data-through-encryption",
"services": [
- "AKV",
"Storage",
- "SQL"
+ "SQL",
+ "AKV"
],
"severity": "Low",
"subcategory": "Column Encryption",
@@ -21149,9 +24701,9 @@
"guid": "c614ac47-bebf-4061-b0a1-43e0c6b5e00d",
"link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server",
"services": [
- "Backup",
"Storage",
- "SQL"
+ "SQL",
+ "Backup"
],
"severity": "High",
"subcategory": "Transparent Data Encryption",
@@ -21165,8 +24717,8 @@
"guid": "2edb4165-4f54-47cc-a891-5c82c2f21e25",
"link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-overview",
"services": [
- "AKV",
- "SQL"
+ "SQL",
+ "AKV"
],
"severity": "Medium",
"subcategory": "Transparent Data Encryption",
@@ -21242,9 +24794,9 @@
"services": [
"Entra",
"AKV",
- "SQL",
"RBAC",
- "ACR"
+ "ACR",
+ "SQL"
],
"severity": "Low",
"subcategory": "Managed Identities",
@@ -21363,12 +24915,12 @@
"guid": "9b64bc50-b60f-4035-bf7a-28c4806dfb46",
"link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
"services": [
+ "Monitor",
+ "EventHubs",
+ "Storage",
"Entra",
"Backup",
- "Storage",
- "SQL",
- "Monitor",
- "EventHubs"
+ "SQL"
],
"severity": "Low",
"subcategory": "Auditing",
@@ -21382,11 +24934,11 @@
"guid": "fcd34708-87ac-4efc-aaf6-57a47f76644a",
"link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
"services": [
+ "Monitor",
+ "EventHubs",
"Storage",
- "SQL",
"Subscriptions",
- "Monitor",
- "EventHubs"
+ "SQL"
],
"severity": "Medium",
"subcategory": "Auditing",
@@ -21400,8 +24952,8 @@
"guid": "f96e127e-9572-453a-b325-ff89ae9f6b44",
"link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
"services": [
- "SQL",
- "Monitor"
+ "Monitor",
+ "SQL"
],
"severity": "Medium",
"subcategory": "SIEM/SOAR",
@@ -21415,8 +24967,8 @@
"guid": "41503bf8-73da-4a10-af9f-5f7fceb5456f",
"link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
"services": [
- "SQL",
- "Monitor"
+ "Monitor",
+ "SQL"
],
"severity": "Medium",
"subcategory": "SIEM/SOAR",
@@ -21445,8 +24997,8 @@
"guid": "2c6d356a-1784-475b-a42c-ec187dc8c925",
"link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
"services": [
- "PrivateLink",
- "SQL"
+ "SQL",
+ "PrivateLink"
],
"severity": "High",
"subcategory": "Connectivity",
@@ -21460,9 +25012,9 @@
"guid": "557b3ce5-bada-4296-8d52-a2d447bc1718",
"link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-architecture",
"services": [
- "PrivateLink",
"SQL",
- "AzurePolicy"
+ "AzurePolicy",
+ "PrivateLink"
],
"severity": "Low",
"subcategory": "Connectivity",
@@ -21522,10 +25074,10 @@
"guid": "246cd832-f550-4af0-9c74-ca9baeeb8860",
"link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server",
"services": [
- "PrivateLink",
- "SQL",
"Monitor",
"VNet",
+ "PrivateLink",
+ "SQL",
"Firewall"
],
"severity": "Medium",
@@ -21540,9 +25092,9 @@
"guid": "3a0808ee-ea7a-47ab-bdce-920a6a2b3881",
"link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server",
"services": [
- "PrivateLink",
"SQL",
- "VNet"
+ "VNet",
+ "PrivateLink"
],
"severity": "High",
"subcategory": "Private Access",
@@ -21556,9 +25108,9 @@
"guid": "8600527e-e8c4-4424-90ef-1f0dca0224f2",
"link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview#network-security-of-private-endpoints",
"services": [
- "PrivateLink",
"SQL",
- "VNet"
+ "VNet",
+ "PrivateLink"
],
"severity": "Medium",
"subcategory": "Private Access",
@@ -21572,8 +25124,8 @@
"guid": "18123ef4-a0a6-45e3-87fe-7f454f65d975",
"link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connectivity-architecture-overview",
"services": [
- "VNet",
"SQL",
+ "VNet",
"ExpressRoute"
],
"severity": "Medium",
@@ -21588,8 +25140,8 @@
"guid": "55187443-6852-4fbd-99c6-ce303597ca7f",
"link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview?view=azuresql#ip-vs-virtual-network-firewall-rules",
"services": [
- "VNet",
"SQL",
+ "VNet",
"AzurePolicy"
],
"severity": "High",
@@ -21634,8 +25186,8 @@
"guid": "b8435656-143e-41a8-9922-61d34edb751a",
"link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview",
"services": [
- "VNet",
"SQL",
+ "VNet",
"AzurePolicy"
],
"severity": "High",
@@ -21650,8 +25202,8 @@
"guid": "057dd298-8726-4aa6-b590-1f81d2e30421",
"link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview",
"services": [
- "VNet",
- "SQL"
+ "SQL",
+ "VNet"
],
"severity": "High",
"subcategory": "Public Access",
@@ -21972,8 +25524,8 @@
"link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
"service": "Key Vault",
"services": [
- "AKV",
- "ACR"
+ "ACR",
+ "AKV"
],
"severity": "Medium",
"subcategory": "High Availability",
@@ -22001,8 +25553,8 @@
"link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
"service": "Key Vault",
"services": [
- "AKV",
- "AzurePolicy"
+ "AzurePolicy",
+ "AKV"
],
"severity": "Medium",
"subcategory": "High Availability",
@@ -22016,11 +25568,11 @@
"link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
"service": "Key Vault",
"services": [
- "AKV",
"Storage",
- "Backup",
+ "Subscriptions",
+ "AKV",
"ASR",
- "Subscriptions"
+ "Backup"
],
"severity": "Medium",
"subcategory": "Business continuity and disaster recovery",
@@ -22034,8 +25586,8 @@
"link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
"service": "Key Vault",
"services": [
- "AKV",
- "ASR"
+ "ASR",
+ "AKV"
],
"severity": "High",
"subcategory": "Business continuity and disaster recovery",
@@ -22049,8 +25601,8 @@
"link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
"service": "Key Vault",
"services": [
- "AKV",
- "ASR"
+ "ASR",
+ "AKV"
],
"severity": "Low",
"subcategory": "Business continuity and disaster recovery",
@@ -22064,9 +25616,9 @@
"link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
"service": "Key Vault",
"services": [
+ "ASR",
"AKV",
- "Backup",
- "ASR"
+ "Backup"
],
"severity": "Low",
"subcategory": "Business continuity and disaster recovery",
@@ -22080,9 +25632,9 @@
"link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
"service": "Key Vault",
"services": [
+ "ASR",
"AKV",
- "Backup",
- "ASR"
+ "Backup"
],
"severity": "Low",
"subcategory": "Business continuity and disaster recovery",
@@ -22096,9 +25648,9 @@
"link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
"service": "Key Vault",
"services": [
- "AKV",
+ "EventHubs",
"ASR",
- "EventHubs"
+ "AKV"
],
"severity": "Medium",
"subcategory": "Business continuity and disaster recovery",
@@ -22202,8 +25754,8 @@
"link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction",
"service": "VM",
"services": [
- "Backup",
- "VM"
+ "VM",
+ "Backup"
],
"severity": "High",
"subcategory": "Virtual Machines",
@@ -22248,9 +25800,9 @@
"link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk",
"service": "VM",
"services": [
- "SQL",
+ "VM",
"Storage",
- "VM"
+ "SQL"
],
"severity": "Medium",
"subcategory": "Virtual Machines",
@@ -22265,8 +25817,8 @@
"link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
"service": "VM",
"services": [
- "Storage",
"VM",
+ "Storage",
"ACR"
],
"severity": "Medium",
@@ -22297,8 +25849,8 @@
"link": "https://learn.microsoft.com/azure/virtual-machines/availability",
"service": "VM",
"services": [
- "ASR",
- "VM"
+ "VM",
+ "ASR"
],
"severity": "High",
"subcategory": "Virtual Machines",
@@ -22313,9 +25865,9 @@
"link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
"service": "VM",
"services": [
- "AVS",
"VM",
- "ASR"
+ "ASR",
+ "AVS"
],
"severity": "High",
"subcategory": "Virtual Machines",
@@ -22579,10 +26131,10 @@
"guid": "8df03a82-2cd4-463c-abbc-8ac299ebc92a",
"link": "https://learn.microsoft.com/azure/networking/disaster-recovery-dns-traffic-manager",
"services": [
+ "Monitor",
"DNS",
- "TrafficManager",
"ASR",
- "Monitor"
+ "TrafficManager"
],
"severity": "Low",
"subcategory": "DNS",
@@ -22642,8 +26194,8 @@
"guid": "a359c373-e7dd-4616-83a3-64a907ebae48",
"link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
"services": [
- "Backup",
- "ExpressRoute"
+ "ExpressRoute",
+ "Backup"
],
"severity": "Medium",
"subcategory": "ExpressRoute",
@@ -22657,10 +26209,10 @@
"guid": "ead53cc7-de2e-48aa-ab35-71549ab9153d",
"link": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
"services": [
- "VPN",
- "Backup",
"Cost",
- "ExpressRoute"
+ "ExpressRoute",
+ "VPN",
+ "Backup"
],
"severity": "Low",
"subcategory": "ExpressRoute",
@@ -22688,8 +26240,8 @@
"guid": "b2b38c88-6ba2-4c02-8499-114a5d3ce574",
"link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
"services": [
- "LoadBalancer",
- "VM"
+ "VM",
+ "LoadBalancer"
],
"severity": "Low",
"subcategory": "Load Balancers",
@@ -22703,8 +26255,8 @@
"guid": "dccbd979-2a6b-4cca-8b5f-ea1ebf3dd95d",
"link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-custom-probe-overview#design-guidance",
"services": [
- "LoadBalancer",
- "Monitor"
+ "Monitor",
+ "LoadBalancer"
],
"severity": "Low",
"subcategory": "Load Balancers",
@@ -22733,8 +26285,8 @@
"guid": "927139b8-2110-42db-b6ea-f11e6f843e53",
"link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
"services": [
- "VPN",
- "ACR"
+ "ACR",
+ "VPN"
],
"severity": "Medium",
"subcategory": "VPN Gateways",
@@ -22756,6344 +26308,6212 @@
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "WAF checklist",
- "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
- "service": "IoT Hub DPS",
- "services": [
- "WAF"
- ],
- "severity": "High",
- "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "WAF checklist",
- "guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "IoT Hub DPS",
- "services": [
- "WAF"
- ],
- "severity": "High",
- "text": "Protect logic apps from region failures with zone redundancy and availability zones",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "WAF checklist",
- "guid": "8aed4fbf-0830-4883-899d-222a154af478",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "IoT Hub DPS",
- "services": [
- "WAF"
- ],
- "severity": "High",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Devices/provisioningServices",
- "checklist": "WAF checklist",
- "guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "IoT Hub DPS",
- "services": [
- "AppSvc",
- "WAF"
- ],
- "severity": "High",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Devices/provisioningServices",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "IoT Hub DPS",
+ "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
+ "service": "APIM",
"services": [
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
+ "text": "Implement an error handling policy at the global level",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.Devices/deviceUpdateServices",
- "checklist": "WAF checklist",
- "guid": "0e03f5ee-4648-423c-bb86-7239480f9171",
- "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
- "service": "Device Update for IoT Hub",
- "services": [
- "WAF"
- ],
- "severity": "High",
- "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled).",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Devices/deviceUpdateServices",
- "checklist": "WAF checklist",
- "guid": "c0c273bd-00ad-419a-9f2f-fc72fb181e55",
- "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
- "service": "Device Update for IoT Hub",
- "services": [
- "WAF"
- ],
- "severity": "High",
- "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the DPS instances from an affected region to the corresponding geo-paired region.",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Devices/deviceUpdateServices",
- "checklist": "WAF checklist",
- "guid": "3af8abe6-07eb-4287-b393-6c4abe3702eb",
- "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "Device Update for IoT Hub",
- "services": [
- "WAF"
- ],
- "severity": "High",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Devices/deviceUpdateServices",
- "checklist": "WAF checklist",
- "guid": "bd91245c-fe32-4e98-a085-794a40f4bfe1",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "Device Update for IoT Hub",
- "services": [
- "AppSvc",
- "WAF"
- ],
- "severity": "High",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
- "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
- "service": "Logic Apps",
- "services": [
- "WAF"
- ],
- "severity": "High",
- "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
- "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
- "service": "Logic Apps",
- "services": [
- "WAF"
- ],
- "severity": "High",
- "text": "Protect logic apps from region failures with zone redundancy and availability zones",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
- "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
- "service": "Logic Apps",
- "services": [
- "WAF"
- ],
- "severity": "High",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Web/sites",
- "checklist": "WAF checklist",
- "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
- "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
- "service": "Logic Apps",
- "services": [
- "AppSvc",
- "WAF"
- ],
- "severity": "High",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.Web/sites",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
- "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
- "service": "Logic Apps",
+ "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
+ "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
+ "service": "APIM",
"services": [
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
+ "text": "Ensure all APIs policies include a element.",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "WAF checklist",
- "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
- "service": "Bot service",
- "services": [
- "WAF"
- ],
- "severity": "Medium",
- "text": "Follow reliability support recommendations in Azure Bot Service",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "WAF checklist",
- "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
- "service": "Bot service",
- "services": [
- "WAF"
- ],
- "severity": "Medium",
- "text": "Deploying bots with local data residency and regional compliance",
- "waf": "Reliability"
- },
- {
- "arm-service": "Microsoft.BotService/botServices",
- "checklist": "WAF checklist",
- "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
- "service": "Bot service",
- "services": [
- "WAF"
- ],
- "severity": "Medium",
- "text": "Azure Bot Service runs in active-active mode for both global and regional services. When an outage occurs, you don't need to detect errors or manage the service. Azure Bot Service automatically performs auto failover and auto recovery in a multi-region geographical architecture. For the EU bot regional service, Azure Bot Service provides two full regions inside Europe with active/active replication to ensure redundancy. For the global bot service, all available regions/geographies can be served as the global footprint.",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "WAF checklist",
- "guid": "43e52f47-22d9-428c-8b1c-d521e54a29a9",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foundations-playbooks-CosmosDB_v1.docx",
- "service": "CosmosDB",
- "services": [
- "WAF"
- ],
- "severity": "Medium",
- "text": "FTA Resiliency Playbook",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "WAF checklist",
- "guid": "de39ac0e-7c28-4dc9-9565-7202bff4564b",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
- "service": "CosmosDB",
- "services": [
- "WAF"
- ],
- "severity": "High",
- "text": "Leverage Availablity Zones where regionally applicable and ofcourse if the service offers it",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "WAF checklist",
- "guid": "0d934a34-8b26-43e7-bd60-513a3649906e",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#replica-outages",
- "service": "CosmosDB",
- "services": [
- "WAF"
- ],
- "severity": "Medium",
- "text": "Run multiple replicas of the database (>1 ) in Prod",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.documentdb/databaseAccounts",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "description": "Multi-region writes capability allows you to take advantage of the provisioned throughput for your databases and containers across the globe",
- "guid": "bad38ead-53cc-47de-8d8a-aab3571449ab",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions",
- "service": "CosmosDB",
+ "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
+ "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
+ "service": "APIM",
"services": [
"ACR",
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Leverage Multi-Region Writes",
- "waf": "Reliability"
+ "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "description": "Span Cosmos account across two or more regions with multi-region writes",
- "guid": "8153d89f-89dc-47b3-9be2-b1a27f7b9e91",
- "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
- "service": "CosmosDB",
+ "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
+ "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
+ "service": "APIM",
"services": [
- "ACR",
"WAF"
],
"severity": "Medium",
- "text": "Distribute your data globally",
- "waf": "Reliability"
+ "text": "If you are planning to monetize your APIs, review the 'monetization support' article for best practices",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "description": "Choose from various consistency levels such as Eventual, Consistent Prefix, Session, Bounded Staleness and strong",
- "guid": "9f8ea848-25ec-4140-bc32-2758e6ee9ac0",
- "link": "https://learn.microsoft.com/azure/cosmos-db/consistency-levels",
- "service": "CosmosDB",
+ "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
+ "service": "APIM",
"services": [
+ "Monitor",
"WAF"
],
"severity": "High",
- "text": "Choose from several well-defined consistency models",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "WAF checklist",
- "description": "Maintain business continuity during regional outages. Azure Cosmos DB supports service-managed failover during a regional outage. During a regional outage, Azure Cosmos DB continues to maintain its latency, availability, consistency, and throughput SLAs. To help make sure that your entire application is highly available, Azure Cosmos DB offers a manual failover API to simulate a regional outage. By using this API, you can carry out regular business continuity drills.",
- "guid": "a47e4d1e-bb79-43f9-bf87-69e1032b72fe",
- "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover",
- "service": "CosmosDB",
- "services": [
- "CosmosDB",
- "WAF"
- ],
- "severity": "Medium",
- "text": "Enable Service managed failover",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "WAF checklist",
- "description": "Azure Cosmos DB automatically takes backups of your data at regular intervals. The automatic backups are taken without affecting the performance or availability of the database operations. All the backups are stored separately in a storage service.",
- "guid": "3499c9c1-133d-42f7-a4b1-a5bd06ff1a90",
- "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore",
- "service": "CosmosDB",
- "services": [
- "Backup",
- "Storage",
- "CosmosDB",
- "WAF"
- ],
- "severity": "Medium",
- "text": "Enable Automatic Backups",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "Reliability"
- },
- {
- "arm-service": "microsoft.documentdb/databaseAccounts",
- "checklist": "WAF checklist",
- "description": "This mode is the default backup mode for all existing accounts. In this mode, backup is taken at a periodic interval and the data is restored by creating a request with the support team. In this mode, you configure a backup interval and retention for your account. The maximum retention period extends to a month. The minimum backup interval can be one hour.",
- "guid": "a6eb33f6-005c-4d92-9286-7655672d6121",
- "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction",
- "service": "CosmosDB",
- "services": [
- "Backup",
- "WAF"
- ],
- "severity": "Medium",
- "text": "Perform Periodic Backups",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Reliability"
+ "text": "Enable Diagnostics Settings to export logs to Azure Monitor",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.documentdb/databaseAccounts",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "description": "Continous 7 day retention and 30 day retention backups. Azure Cosmos DB performs data backup in the background without consuming any extra provisioned throughput (RUs) or affecting the performance and availability of your database. Continuous backups are taken in every region where the account exists.",
- "guid": "d43918a8-cd28-49be-b6b1-7cb8245461e1",
- "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction",
- "service": "CosmosDB",
+ "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
+ "service": "APIM",
"services": [
- "Backup",
- "CosmosDB",
"WAF"
],
"severity": "Medium",
- "text": "Continous Backup with point-in-time restore in Azure Cosmos DB",
- "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
- "waf": "Reliability"
+ "text": "Enable Application Insights for more detailed telemetry",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Search/searchServices",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
+ "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
+ "service": "APIM",
"services": [
+ "Monitor",
"WAF"
],
"severity": "High",
- "text": "Enable 2 replicas to have 99.9% availability for read operations",
- "waf": "Reliability"
+ "text": "Configure alerts on the most critical metrics",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Search/searchServices",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
- "service": "Cognitive Search",
+ "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
+ "service": "APIM",
"services": [
- "WAF"
+ "WAF",
+ "AKV"
],
- "severity": "Medium",
- "text": "Enable 3 replicas to have 99.9% availability for read/write operations",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Ensure that custom SSL certificates are stored an Azure Key Vault so they can be securely accessed and updated",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Search/searchServices",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
- "service": "Cognitive Search",
+ "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
+ "service": "APIM",
"services": [
+ "Entra",
"WAF"
],
"severity": "High",
- "text": "Leverage Availability Zones by enabling read and/or write replicas",
- "waf": "Reliability"
+ "text": "Protect incoming requests to APIs (data plane) with Azure AD",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Search/searchServices",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
- "service": "Cognitive Search",
+ "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
+ "service": "APIM",
"services": [
- "ACR",
+ "Entra",
"WAF"
],
"severity": "Medium",
- "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions",
- "waf": "Reliability"
+ "text": "Use Microsoft Entra ID to authenticate users in the Developer Portal",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Search/searchServices",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
- "service": "Cognitive Search",
+ "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
+ "service": "APIM",
"services": [
- "ACR",
"WAF"
],
"severity": "Medium",
- "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services",
- "waf": "Reliability"
+ "text": "Create appropriate groups to control the visibility of the products",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Search/searchServices",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
- "service": "Cognitive Search",
+ "guid": "06862505-2d9a-4874-9491-2837b00a3475",
+ "link": "https://learn.microsoft.com/azure/api-management/backends",
+ "service": "APIM",
"services": [
- "TrafficManager",
"WAF"
],
"severity": "Medium",
- "text": "Use Azure Traffic Manager to coordinate requests",
- "waf": "Reliability"
+ "text": "Use Backends feature to eliminate redundant API backend configurations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Search/searchServices",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
- "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
- "service": "Cognitive Search",
+ "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
+ "service": "APIM",
"services": [
- "Storage",
- "Backup",
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Use Named Values to store common values that can be used in policies",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "21c30d25-ffb7-4f6a-b9ea-b3fec328f787",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-cog_svcs_v1.docx",
- "service": "Cognitive Services",
+ "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
+ "service": "APIM",
"services": [
+ "ACR",
"WAF"
],
"severity": "Medium",
- "text": "Leverage FTA HandBook for Cognitive Services",
+ "text": "For DR, leverage the premium tier with deployments scaled across two or more regions for 99.99% SLA",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "78c34698-16b2-4763-aefe-1b9b599de0d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
- "service": "Cognitive Services",
+ "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
+ "link": "https://learn.microsoft.com/azure/api-management/high-availability",
+ "service": "APIM",
"services": [
- "Backup",
"WAF"
],
"severity": "Medium",
- "text": "Backup Your Prompts",
+ "text": "Deploy at least one unit in two or more availability zones for an increased SLA of 99.99%",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "750ab2ab-039d-4a6d-95d7-c892adb107d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
- "service": "Cognitive Services",
+ "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
+ "service": "APIM",
"services": [
- "ASR",
- "WAF"
+ "WAF",
+ "Backup"
],
"severity": "High",
- "text": "Business Continuity and Disaster Recovery (BCDR) considerations with Azure OpenAI Service",
+ "text": "Ensure there is an automated backup routine",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "325af625-ca44-4e46-a5e2-223ace8bb123",
- "link": "https://github.com/abacaj/chatgpt-backup#backup-your-chatgpt-conversations",
- "service": "Cognitive Services",
+ "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
+ "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
+ "service": "APIM",
"services": [
- "Backup",
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Backup Your ChatGPT conversations",
+ "text": "Use Policies to add a fail-over backend URL and caching to reduce failing calls.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "07ca5f17-f154-4e3a-a369-2829e7e31618",
- "link": "https://learn.microsoft.com/azure/ai-services/speech-service/how-to-custom-speech-continuous-integration-continuous-deployment",
- "service": "Cognitive Services",
+ "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
+ "service": "APIM",
"services": [
- "WAF"
+ "EventHubs",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "CI/CD for custom speech",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "If you need to log at high performance levels, consider Event Hubs policy",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "3687a046-7a1f-4893-9bda-43324f248116",
- "link": "https://learn.microsoft.com/azure/ai-services/qnamaker/tutorials/export-knowledge-base",
- "service": "Cognitive Services",
+ "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
+ "service": "APIM",
"services": [
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Low",
- "text": "Move a knowledge base using export-import",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Apply throttling policies to control the number of requests per second",
+ "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.App/containerApps",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "af416482-663c-4ed6-b195-b44c7068e09c",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#availability-zone-support",
- "service": "Container Apps",
+ "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
+ "service": "APIM",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Leverage Availability Zones if regionally applicable",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Configure autoscaling to scale out the number of instances when the load increases",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.App/containerApps",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "95bc80ec-6499-4d14-a7d2-7d296b1d8abc",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#set-up-zone-redundancy-in-your-container-apps-environment",
- "service": "Container Apps",
+ "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
+ "service": "APIM",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Use more than one replica and enable Zone Redundancy.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Deploy self-hosted gateways where Azure doesn't have a region close to the backend APIs.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.App/containerApps",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "ccaa4fc2-fdbc-4432-8bb7-f7e6469e4dc3",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
- "service": "Container Apps",
+ "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
+ "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
+ "service": "APIM",
"services": [
"WAF"
],
- "severity": "High",
- "text": "For cross-region DR, deploy container apps in multiple regions and follow active/active or active/passive application guidance.",
+ "severity": "Medium",
+ "text": "Use the premium tier for production workloads.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.App/containerApps",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "2ffada86-c031-4933-bf7d-0c45bc4e5919",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
- "service": "Container Apps",
+ "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
+ "service": "APIM",
"services": [
- "TrafficManager",
- "FrontDoor",
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Use Front Door or Traffic Manager to route traffic to the closest region",
+ "severity": "Medium",
+ "text": "In multi-region model, use Policies to route the requests to regional backends based on availability or latency.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "service": "Azure Functions",
+ "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
+ "service": "APIM",
"services": [
- "WAF"
+ "Entra",
+ "WAF",
+ "APIM"
],
"severity": "High",
- "text": "Select the right Function hosting plan based on your business & SLO requirements",
+ "text": "Be aware of APIM's limits",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
- "service": "Azure Functions",
+ "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
+ "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
+ "service": "APIM",
"services": [
"WAF"
],
"severity": "High",
- "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)",
+ "text": "Ensure that the self-hosted gateway deployments are resilient.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
- "service": "Azure Functions",
+ "guid": "7519e385-a88b-4d34-966b-6269d686e890",
+ "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
+ "service": "APIM",
"services": [
- "WAF"
+ "Entra",
+ "FrontDoor",
+ "WAF",
+ "APIM"
],
"severity": "Medium",
- "text": "Consider a Cross-Region DR strategy for critical workloads",
- "waf": "Reliability"
+ "text": "Use Azure Front Door in front of APIM for multi-region deployment",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Web/sites",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
- "service": "Azure Functions",
+ "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
+ "service": "APIM",
"services": [
- "AppSvc",
+ "VNet",
"WAF"
],
- "severity": "High",
- "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Deploy the service within a Virtual Network (VNet)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "service": "Azure Functions",
+ "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
+ "service": "APIM",
"services": [
- "AppSvc",
- "WAF"
+ "Monitor",
+ "Entra",
+ "VNet",
+ "WAF",
+ "APIM"
],
- "severity": "High",
- "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic to/from APIM.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
- "service": "Azure Functions",
+ "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
+ "service": "APIM",
"services": [
- "Storage",
- "WAF"
+ "Entra",
+ "VNet",
+ "WAF",
+ "APIM",
+ "PrivateLink"
],
"severity": "Medium",
- "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled",
- "waf": "Reliability"
+ "text": "Deploy Private Endpoints to filter incoming traffic when APIM is not deployed to a VNet.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Web/sites",
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
- "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
- "service": "Azure Functions",
+ "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
+ "service": "APIM",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Disable Public Network Access",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
- "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
- "service": "SAP",
+ "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
+ "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
+ "service": "APIM",
"services": [
- "SAP",
"WAF"
],
"severity": "Medium",
- "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
+ "text": "Simplify management with PowerShell automation scripts",
"waf": "Operations"
},
{
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
- "service": "SAP",
+ "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
+ "service": "APIM",
"services": [
- "SAP",
- "WAF"
+ "Entra",
+ "WAF",
+ "APIM"
],
"severity": "Medium",
- "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.",
- "training": "https://github.com/Azure/sap-automation",
+ "text": "Configure APIM via Infrastructure-as-code. Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator",
"waf": "Operations"
},
{
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
- "service": "SAP",
+ "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
+ "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
+ "service": "APIM",
"services": [
- "SAP",
- "WAF"
+ "Entra",
+ "WAF",
+ "APIM"
],
"severity": "Medium",
- "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally",
- "waf": "Reliability"
+ "text": "Promote usage of Visual Studio Code APIM extension for faster API development",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
- "service": "SAP",
+ "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
+ "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
+ "service": "APIM",
"services": [
- "Backup",
"WAF"
],
"severity": "Medium",
- "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.",
- "waf": "Reliability"
- },
- {
- "checklist": "WAF checklist",
- "guid": "b651423c-8552-42db-a545-5cb50c05527a",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "SAP",
- "services": [
- "Backup",
- "SQL",
- "Storage",
- "ASR",
- "SAP",
- "WAF"
- ],
- "severity": "High",
- "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "Reliability"
+ "text": "Implement DevOps and CI/CD in your workflow",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
+ "guid": "b6439493-426a-45f3-9697-cf65baee208d",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
+ "service": "APIM",
"services": [
- "SAP",
"WAF"
],
"severity": "Medium",
- "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
- "waf": "Reliability"
- },
- {
- "checklist": "WAF checklist",
- "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
- "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
- "service": "SAP",
- "services": [
- "VPN",
- "ASR",
- "ExpressRoute",
- "WAF"
- ],
- "severity": "High",
- "text": "Set up ExpressRoute connections from on-premises to the primary and secondary Azure disaster recovery regions. Also, as an alternative to using ExpressRoute, consider setting up VPN connections from on-premises to the primary and secondary Azure disaster recovery regions.",
- "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
- "waf": "Reliability"
+ "text": "Secure APIs using client certificate authentication",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "SAP",
+ "guid": "2a67d143-1033-4c0a-8732-680896478f08",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
+ "service": "APIM",
"services": [
- "AKV",
- "ACR",
"WAF"
],
- "severity": "Low",
- "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Secure backend services using client certificate authentication",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
- "service": "SAP",
+ "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
+ "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
+ "service": "APIM",
"services": [
- "VNet",
- "SAP",
- "ASR",
"WAF"
],
"severity": "Medium",
- "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.",
- "waf": "Reliability"
+ "text": "Review 'Recommendations to mitigate OWASP API Security Top 10 threats' article and check what is applicable to your APIs",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
- "service": "SAP",
+ "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
+ "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
+ "service": "APIM",
"services": [
- "SAP",
- "Storage",
"WAF"
],
- "severity": "Low",
- "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.",
- "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
+ "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
+ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
+ "service": "APIM",
"services": [
"WAF"
],
"severity": "High",
- "text": "Native database replication technology should be used to synchronize the database in a HA pair.",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
- "waf": "Reliability"
+ "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
- "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
- "service": "SAP",
+ "guid": "f8af3d94-1d2b-4070-846f-849197524258",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
+ "service": "APIM",
"services": [
- "VNet",
- "WAF"
+ "WAF",
+ "AKV"
],
"severity": "High",
- "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "Reliability"
+ "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
- "service": "SAP",
+ "guid": "791abd8b-7706-4e31-9569-afefde724be3",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
+ "service": "APIM",
"services": [
"Entra",
- "ASR",
- "VM",
"WAF"
],
- "severity": "High",
- "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Use managed identities to authenticate to other Azure resources whenever possible",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.ApiManagement/service",
"checklist": "WAF checklist",
- "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
+ "service": "APIM",
"services": [
- "SAP",
- "WAF"
+ "Entra",
+ "AppGW",
+ "WAF",
+ "APIM"
],
"severity": "High",
- "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
- "waf": "Reliability"
+ "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AppPlatform/Spring",
"checklist": "WAF checklist",
- "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
- "service": "SAP",
+ "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
+ "service": "Spring Apps",
"services": [
- "SAP",
"WAF"
],
- "severity": "High",
- "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "severity": "Medium",
+ "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions",
"waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AppPlatform/Spring",
"checklist": "WAF checklist",
- "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
- "service": "SAP",
+ "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
+ "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
+ "service": "Spring Apps",
"services": [
- "Storage",
- "VM",
- "WAF"
+ "TrafficManager",
+ "WAF",
+ "FrontDoor"
],
- "severity": "High",
- "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.",
- "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
+ "severity": "Medium",
+ "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.",
"waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AppPlatform/Spring",
"checklist": "WAF checklist",
- "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
- "service": "SAP",
+ "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
+ "service": "Spring Apps",
"services": [
- "SAP",
- "Storage",
+ "ACR",
"WAF"
],
- "severity": "High",
- "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
+ "severity": "Medium",
+ "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.",
"waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AppPlatform/Spring",
"checklist": "WAF checklist",
- "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
- "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
- "service": "SAP",
+ "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
+ "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
+ "service": "Spring Apps",
"services": [
- "SAP",
"WAF"
],
- "severity": "High",
- "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "severity": "Medium",
+ "text": "Use more than 1 app instance for your apps",
"waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AppPlatform/Spring",
"checklist": "WAF checklist",
- "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
- "service": "SAP",
+ "guid": "7504c230-6035-4183-95a5-85762acc6075",
+ "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
+ "service": "Spring Apps",
"services": [
- "LoadBalancer",
- "SAP",
+ "Monitor",
"WAF"
],
- "severity": "High",
- "text": "Most failover clusters for SAP application layer components (ASCS) and the DBMS layer require a virtual IP address for a failover cluster. Azure Load Balancer should handle the virtual IP address for all other cases. One design principle is to use one load balancer per cluster configuration. We recommend that you use the standard version of the load balancer (Standard Load Balancer SKU).",
- "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "severity": "Medium",
+ "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.",
"waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AppPlatform/Spring",
"checklist": "WAF checklist",
- "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
- "service": "SAP",
+ "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
+ "service": "Spring Apps",
"services": [
- "LoadBalancer",
"WAF"
],
- "severity": "High",
- "text": "Make sure the Floating IP is enabled on the Load balancer",
- "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "severity": "Medium",
+ "text": "Set up autoscaling in Spring Cloud Gateway",
"waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AppPlatform/Spring",
"checklist": "WAF checklist",
- "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "SAP",
+ "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
+ "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
+ "service": "Spring Apps",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Before you deploy your high-availability infrastructure, and depending on the region you choose, determine whether to deploy with an Azure availability set or an availability zone.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "severity": "Low",
+ "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.",
"waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AppPlatform/Spring",
"checklist": "WAF checklist",
- "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "SAP",
+ "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
+ "link": "https://learn.microsoft.com/azure/spring-apps/overview",
+ "service": "Spring Apps",
"services": [
- "Entra",
- "SAP",
- "VM",
"WAF"
],
- "severity": "High",
- "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.",
+ "severity": "Medium",
+ "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.",
"waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
+ "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
+ "service": "AVS",
"services": [
"Entra",
- "RBAC",
- "VM",
- "WAF"
+ "WAF",
+ "Subscriptions"
],
"severity": "High",
- "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "Reliability"
+ "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
- "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
- "service": "SAP",
+ "guid": "75089c20-990d-4927-b105-885576f76fc2",
+ "service": "AVS",
"services": [
- "WAF"
+ "WAF",
+ "AVS"
],
"severity": "Medium",
- "text": "You can't deploy Azure availability sets within an Azure availability zone unless you use proximity placement groups.",
- "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "waf": "Reliability"
+ "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "SAP",
+ "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
+ "service": "AVS",
"services": [
- "VM",
"WAF"
],
"severity": "High",
- "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.",
- "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
- "waf": "Reliability"
+ "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
+ "service": "AVS",
"services": [
- "Entra",
- "SAP",
"WAF"
],
- "severity": "High",
- "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
+ "service": "AVS",
"services": [
- "SAP",
- "ACR",
"WAF"
],
- "severity": "High",
- "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
+ "service": "AVS",
"services": [
"Entra",
- "SAP",
"WAF"
],
"severity": "High",
- "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
- "service": "SAP",
+ "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
+ "service": "AVS",
"services": [
- "Entra",
- "VM",
- "WAF"
+ "RBAC",
+ "WAF",
+ "AVS"
],
"severity": "Medium",
- "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "text": "Has an RBAC model been created for use within VMware vSphere",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
- "service": "SAP",
+ "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
+ "service": "AVS",
"services": [
- "Storage",
- "VM",
+ "RBAC",
"WAF"
],
"severity": "Medium",
- "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.",
- "waf": "Reliability"
+ "text": "RBAC permissions should be granted on ADDS groups and not on specific users",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
- "service": "SAP",
+ "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
+ "service": "AVS",
"services": [
- "SAP",
- "WAF"
+ "RBAC",
+ "WAF",
+ "AVS"
],
- "severity": "Medium",
- "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
+ "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
+ "service": "AVS",
"services": [
- "Storage",
+ "RBAC",
"WAF"
],
"severity": "High",
- "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
- "waf": "Reliability"
+ "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
- "service": "SAP",
+ "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
+ "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
+ "service": "AVS",
"services": [
- "SAP",
- "Storage",
- "WAF"
+ "WAF",
+ "AVS"
],
"severity": "High",
- "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.",
- "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
- "waf": "Reliability"
+ "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand",
+ "waf": "Performance"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
- "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
- "service": "SAP",
+ "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
+ "service": "AVS",
"services": [
- "SAP",
- "Storage",
- "ASR",
- "WAF"
+ "Monitor",
+ "WAF",
+ "NetworkWatcher",
+ "ExpressRoute",
+ "VPN"
],
"severity": "High",
- "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.",
- "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
- "waf": "Reliability"
+ "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
- "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
+ "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
+ "service": "AVS",
"services": [
- "SAP",
- "Storage",
- "WAF"
+ "Monitor",
+ "WAF",
+ "VM",
+ "NetworkWatcher",
+ "ExpressRoute",
+ "AVS"
],
- "severity": "High",
- "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
- "service": "SAP",
+ "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
+ "service": "AVS",
"services": [
- "SAP",
- "Cost",
- "WAF"
+ "Monitor",
+ "WAF",
+ "VM",
+ "NetworkWatcher",
+ "AVS"
],
"severity": "Medium",
- "text": "Automate SAP System Start-Stop to manage costs.",
- "waf": "Cost"
+ "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
+ "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
+ "service": "AVS",
"services": [
- "Storage",
- "VM",
- "SAP",
- "Cost",
- "WAF"
+ "WAF",
+ "ARS"
],
- "severity": "Low",
- "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.",
- "waf": "Cost"
+ "severity": "High",
+ "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
- "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
- "service": "SAP",
+ "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
+ "service": "AVS",
"services": [
- "Storage",
- "VM",
- "SAP",
- "Cost",
- "WAF"
+ "Entra",
+ "RBAC",
+ "WAF",
+ "AVS"
],
- "severity": "Low",
- "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.",
- "waf": "Cost"
+ "severity": "High",
+ "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
- "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
- "service": "SAP",
+ "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
+ "service": "AVS",
"services": [
+ "Entra",
"RBAC",
- "Subscriptions",
- "WAF"
+ "WAF",
+ "AVS"
],
"severity": "High",
- "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "45911475-e39e-4530-accc-d979366bcda2",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
+ "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
+ "service": "AVS",
"services": [
"Entra",
- "SAP",
- "WAF"
+ "WAF",
+ "AVS"
],
"severity": "Medium",
- "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
+ "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
- "service": "SAP",
+ "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
+ "service": "AVS",
"services": [
- "Entra",
- "SAP",
"WAF"
],
- "severity": "Medium",
- "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.",
+ "severity": "High",
+ "text": "Limit use of CloudAdmin account to emergency access only",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
+ "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
+ "service": "AVS",
"services": [
- "SAP",
+ "RBAC",
"WAF"
],
"severity": "Medium",
- "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
- "service": "SAP",
+ "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
+ "service": "AVS",
"services": [
- "SAP",
"WAF"
],
"severity": "Medium",
- "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
+ "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
- "service": "SAP",
+ "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
+ "service": "AVS",
"services": [
- "SAP",
- "WAF"
+ "VM",
+ "WAF",
+ "AVS",
+ "Entra"
],
- "severity": "Medium",
- "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
+ "severity": "High",
+ "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
- "service": "SAP",
- "services": [
- "SAP",
- "AKV",
+ "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
+ "service": "AVS",
+ "services": [
"WAF"
],
"severity": "Medium",
- "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
- "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
+ "text": "Is East-West traffic filtering implemented within NSX-T",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
- "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
- "service": "SAP",
+ "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
+ "service": "AVS",
"services": [
- "SAP",
- "AKV",
- "WAF"
+ "AppGW",
+ "WAF",
+ "AVS",
+ "Firewall"
],
- "severity": "Medium",
- "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
+ "severity": "High",
+ "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "16785d6f-a96c-496a-b885-18f482734c88",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
- "service": "SAP",
+ "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
+ "service": "AVS",
"services": [
- "SAP",
- "WAF"
+ "WAF",
+ "AVS"
],
- "severity": "Medium",
- "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.",
+ "severity": "High",
+ "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
- "service": "SAP",
+ "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
+ "service": "AVS",
"services": [
- "SAP",
- "WAF"
+ "Monitor",
+ "WAF",
+ "AVS"
],
"severity": "Medium",
- "text": "Implement SSO to SAP HANA",
+ "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
- "service": "SAP",
+ "guid": "334fdf91-c234-4182-a652-75269440b4be",
+ "service": "AVS",
"services": [
- "Entra",
- "SAP",
- "WAF"
+ "VNet",
+ "WAF",
+ "DDoS",
+ "ExpressRoute",
+ "VPN"
],
"severity": "Medium",
- "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.",
+ "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
- "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
- "service": "SAP",
+ "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
+ "service": "AVS",
"services": [
- "SAP",
- "WAF"
+ "WAF",
+ "AVS"
],
"severity": "Medium",
- "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.",
+ "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
- "service": "SAP",
+ "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
+ "service": "AVS",
"services": [
- "Entra",
- "SAP",
- "WAF"
+ "Defender",
+ "WAF",
+ "AVS"
],
"severity": "Medium",
- "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.",
+ "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
- "service": "SAP",
+ "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
+ "service": "AVS",
"services": [
- "SAP",
- "WAF"
+ "Arc",
+ "WAF",
+ "AVS"
],
"severity": "Medium",
- "text": "Implement SSO to SAP BTP",
+ "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
- "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
- "service": "SAP",
+ "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
+ "service": "AVS",
"services": [
- "Entra",
- "SAP",
- "WAF"
+ "SQL",
+ "WAF",
+ "AVS"
],
- "severity": "Medium",
- "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.",
+ "severity": "Low",
+ "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
- "service": "SAP",
+ "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
+ "service": "AVS",
"services": [
- "SAP",
- "Subscriptions",
- "AzurePolicy",
- "WAF"
+ "WAF",
+ "AKV"
],
- "severity": "Medium",
- "text": "enforce existing Management Group policies to SAP Subscriptions",
- "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "guid": "5ac94222-3e13-4810-9230-81a941741583",
+ "service": "AVS",
"services": [
- "SAP",
- "Subscriptions",
- "WAF"
+ "WAF",
+ "AVS"
],
- "severity": "High",
- "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
+ "service": "AVS",
"services": [
- "Subscriptions",
"WAF"
],
"severity": "High",
- "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ",
- "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
- "waf": "Operations"
+ "text": "Ensure that the appropriate vSAN Data redundancy method is used (RAID specification)",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
- "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
- "service": "SAP",
+ "guid": "d88408f3-7273-44c8-96ba-280214590146",
+ "service": "AVS",
"services": [
- "VM",
- "Subscriptions",
- "WAF"
+ "Storage",
+ "WAF",
+ "AzurePolicy"
],
"severity": "High",
- "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)",
- "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "waf": "Operations"
+ "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
- "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
- "service": "SAP",
+ "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
+ "service": "AVS",
"services": [
+ "ASR",
"WAF"
],
- "severity": "Low",
- "text": "The Quota API is a REST API that you can use to view and manage quotas for Azure services. Consider using it if necessary.",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
- "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
- "service": "SAP",
+ "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
+ "service": "AVS",
"services": [
- "VM",
- "Subscriptions",
"WAF"
],
- "severity": "High",
- "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.",
+ "severity": "Medium",
+ "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.",
"waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
- "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
- "service": "SAP",
+ "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
+ "service": "AVS",
"services": [
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
+ "severity": "Medium",
+ "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes",
"waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
- "service": "SAP",
+ "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
+ "service": "AVS",
"services": [
- "TrafficManager",
"Cost",
- "WAF"
+ "WAF",
+ "AVS"
],
"severity": "Medium",
- "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)",
- "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
- "waf": "Operations"
+ "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used",
+ "waf": "Cost"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
+ "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
+ "service": "AVS",
"services": [
- "Backup",
- "WAF"
+ "Cost",
+ "WAF",
+ "AVS"
],
- "severity": "High",
- "text": "Help protect your HANA database by using the Azure Backup service.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution",
+ "waf": "Cost"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
- "service": "SAP",
+ "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
+ "service": "AVS",
"services": [
- "Entra",
- "Storage",
- "VM",
"WAF"
],
"severity": "Medium",
- "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.",
- "waf": "Reliability"
+ "text": "Consider the use of Azure Private-Link when using other Azure Native Services",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
+ "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
+ "service": "AVS",
"services": [
- "SAP",
"WAF"
],
"severity": "High",
- "text": "Ensure time-zone matches between the operating system and the SAP system.",
- "waf": "Operations"
+ "text": "Ensure all required resource reside within the same Azure availability zone(s)",
+ "waf": "Performance"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
- "service": "SAP",
+ "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
+ "service": "AVS",
"services": [
- "Entra",
- "WAF"
+ "VM",
+ "Defender",
+ "WAF",
+ "AVS"
],
"severity": "Medium",
- "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Reliability"
+ "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
- "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
- "service": "SAP",
+ "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
+ "service": "AVS",
"services": [
- "Cost",
- "WAF"
+ "VM",
+ "Arc",
+ "WAF",
+ "AVS"
],
- "severity": "Low",
- "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
- "link": "https://learn.microsoft.com/azure/lighthouse/overview",
- "service": "SAP",
+ "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
+ "service": "AVS",
"services": [
- "Entra",
- "SAP",
- "WAF"
+ "WAF",
+ "AVS"
],
- "severity": "Medium",
- "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.",
+ "severity": "High",
+ "text": "Enable Diagnostic and metric logging on Azure VMware Solution",
"waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
- "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
- "service": "SAP",
+ "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
+ "service": "AVS",
"services": [
"VM",
- "WAF"
+ "Monitor",
+ "WAF",
+ "AVS"
],
"severity": "Medium",
- "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.",
- "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
+ "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads",
"waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
- "service": "SAP",
+ "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
+ "service": "AVS",
"services": [
- "SAP",
- "WAF"
+ "AzurePolicy",
+ "WAF",
+ "VM",
+ "Backup",
+ "AVS"
],
- "severity": "Low",
- "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
+ "severity": "Medium",
+ "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads",
"waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
- "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
- "service": "SAP",
+ "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
+ "service": "AVS",
"services": [
- "SAP",
+ "Defender",
"Monitor",
- "SQL",
+ "WAF",
+ "AVS"
+ ],
+ "severity": "Medium",
+ "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
+ "service": "AVS",
+ "services": [
+ "Defender",
"WAF"
],
"severity": "Medium",
- "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
- "waf": "Operations"
+ "text": "Are the applicable compliance baselines added to Microsoft Defender for Cloud",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
- "service": "SAP",
+ "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
+ "service": "AVS",
+ "services": [
+ "WAF",
+ "AVS"
+ ],
+ "severity": "High",
+ "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
+ "service": "AVS",
"services": [
- "Entra",
- "VM",
- "Monitor",
- "SAP",
"WAF"
],
"severity": "High",
- "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.",
- "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
- "waf": "Operations"
+ "text": "Are data processing implications (service provider / service consumer model) clear and documented",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "SAP",
+ "guid": "547c1747-dc56-4068-a714-435cd19dd244",
+ "service": "AVS",
"services": [
- "AzurePolicy",
"WAF"
],
"severity": "Medium",
- "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ",
- "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
- "waf": "Operations"
+ "text": "Consider using CMK (Customer Managed Key) for vSAN only if needed for compliance reason(s).",
+ "waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
- "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
- "service": "SAP",
+ "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
+ "service": "AVS",
"services": [
- "NetworkWatcher",
- "SAP",
"Monitor",
- "WAF"
+ "WAF",
+ "AVS"
],
- "severity": "Medium",
- "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
+ "severity": "High",
+ "text": "Create dashboards to enable core Azure VMware Solution monitoring insights",
"waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "73686af4-6791-4f89-95ad-a43324e13811",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
- "service": "SAP",
+ "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
+ "service": "AVS",
"services": [
- "SAP",
- "VM",
- "WAF"
+ "Monitor",
+ "WAF",
+ "AVS"
],
- "severity": "Medium",
- "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.",
+ "severity": "High",
+ "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)",
"waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
- "service": "SAP",
+ "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
+ "service": "AVS",
"services": [
- "SAP",
- "Subscriptions",
- "WAF"
+ "Monitor",
+ "WAF",
+ "AVS"
],
"severity": "High",
- "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.",
- "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "waf": "Performance"
+ "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
- "service": "SAP",
+ "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
+ "service": "AVS",
"services": [
- "Storage",
- "ASR",
+ "Monitor",
"WAF"
],
- "severity": "Medium",
- "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.",
- "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Ensure alerts are configured for Azure Service Health alerts and notifications",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
- "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
- "service": "SAP",
+ "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
+ "service": "AVS",
"services": [
- "SAP",
- "Sentinel",
- "Monitor",
- "WAF"
+ "Storage",
+ "WAF",
+ "AVS"
],
"severity": "Medium",
- "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.",
- "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
- "waf": "Security"
+ "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "service": "SAP",
+ "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
+ "service": "AVS",
"services": [
- "Cost",
- "WAF"
+ "WAF",
+ "AVS"
],
- "severity": "Medium",
- "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.",
- "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
+ "severity": "Low",
+ "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?",
"waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
- "service": "SAP",
+ "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
+ "service": "AVS",
"services": [
- "Monitor",
"VM",
- "WAF"
+ "Storage",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Low",
- "text": "Use inter-VM latency monitoring for latency-sensitive applications.",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
- "service": "SAP",
+ "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
+ "service": "AVS",
"services": [
- "SAP",
- "Monitor",
- "ASR",
"WAF"
],
"severity": "Medium",
- "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
- "waf": "Reliability"
+ "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
- "service": "SAP",
+ "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
+ "service": "AVS",
"services": [
- "SAP",
"Storage",
- "WAF"
+ "WAF",
+ "Backup"
],
"severity": "Medium",
- "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.",
- "waf": "Performance"
+ "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "c027f893-f404-41a9-b33d-39d625a14964",
- "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
- "service": "SAP",
+ "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
+ "service": "AVS",
"services": [
- "SAP",
- "WAF"
+ "Arc",
+ "WAF",
+ "AVS"
],
- "severity": "Low",
- "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
- "service": "SAP",
+ "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
+ "service": "AVS",
"services": [
- "SAP",
- "Storage",
- "WAF"
+ "Monitor",
+ "WAF",
+ "AVS"
],
"severity": "Medium",
- "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.",
- "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
- "waf": "Performance"
+ "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
- "service": "SAP",
+ "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
+ "service": "AVS",
"services": [
- "SAP",
- "SQL",
- "WAF"
+ "WAF",
+ "AVS"
],
"severity": "Medium",
- "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.",
- "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
- "waf": "Performance"
+ "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
+ "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
+ "service": "AVS",
"services": [
- "SAP",
"Monitor",
- "ASR",
- "WAF"
+ "WAF",
+ "AVS",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
- "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "severity": "Medium",
+ "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions",
"waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "SAP",
+ "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
+ "service": "AVS",
"services": [
- "AppGW",
- "AzurePolicy",
- "WAF"
+ "Defender",
+ "WAF",
+ "AVS"
],
"severity": "Medium",
- "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
+ "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
+ "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
+ "service": "AVS",
"services": [
- "DNS",
- "SAP",
- "VM",
- "WAF"
+ "WAF",
+ "Backup"
],
"severity": "Medium",
- "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
- "waf": "Operations"
+ "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "service": "SAP",
+ "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
+ "service": "AVS",
"services": [
- "DNS",
- "SAP",
- "VNet",
"WAF"
],
"severity": "Medium",
- "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
- "waf": "Operations"
+ "text": "Have all DR solutions been considered and a solution that is best for your business been decided upon? [SRM/JetStream/Zerto/Veeam/...]",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "a3592829-e6e2-4061-9368-6af46791f893",
- "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
- "service": "SAP",
+ "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
+ "service": "AVS",
"services": [
- "SAP",
- "ACR",
- "VNet",
+ "ASR",
"WAF"
],
"severity": "Medium",
- "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions",
- "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
+ "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS",
"waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
- "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
- "service": "SAP",
+ "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
+ "service": "AVS",
"services": [
- "SAP",
- "NVA",
"WAF"
],
"severity": "High",
- "text": "It is not supported to deploy any NVA between SAP application and SAP Database server",
- "training": "https://me.sap.com/notes/2731110",
- "waf": "Performance"
+ "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
- "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
- "service": "SAP",
+ "guid": "8255461e-2aee-4345-9aec-8339248b262d",
+ "service": "AVS",
"services": [
- "VWAN",
- "ACR",
- "SAP",
+ "ASR",
"WAF"
],
"severity": "Medium",
- "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
- "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
- "waf": "Operations"
+ "text": "Use the geopolitical region pair as the secondary disaster recovery environment",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
- "service": "SAP",
+ "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
+ "service": "AVS",
"services": [
- "VNet",
- "NVA",
"WAF"
],
- "severity": "Medium",
- "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.",
- "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
- "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
- "service": "SAP",
+ "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
+ "service": "AVS",
"services": [
"NVA",
- "SAP",
- "VNet",
"WAF",
- "VWAN"
+ "AVS",
+ "ExpressRoute"
],
"severity": "Medium",
- "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.",
- "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
- "waf": "Operations"
+ "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "82734c88-6ba2-4802-8459-11475e39e530",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
+ "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
+ "service": "AVS",
"services": [
- "SAP",
- "VM",
- "WAF"
+ "WAF",
+ "Backup"
],
- "severity": "High",
- "text": "Public IP assignment to VM running SAP Workload is not recommended.",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
- "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
- "service": "SAP",
+ "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
+ "service": "AVS",
"services": [
- "ASR",
- "WAF"
+ "WAF",
+ "AVS",
+ "Backup"
],
- "severity": "High",
- "text": "Consider reserving IP address on DR side when configuring ASR",
- "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
- "service": "SAP",
+ "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
+ "service": "AVS",
"services": [
- "WAF"
+ "WAF",
+ "Backup"
],
- "severity": "High",
- "text": "Avoid using overlapping IP address ranges for production and DR sites.",
- "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Deploy your backup solution outside of vSan, on Azure native components",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
- "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
- "service": "SAP",
+ "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
+ "service": "AVS",
+ "services": [
+ "WAF",
+ "AVS"
+ ],
+ "severity": "Low",
+ "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.AVS/privateClouds",
+ "checklist": "WAF checklist",
+ "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
+ "service": "AVS",
"services": [
- "Storage",
- "VNet",
"WAF"
],
- "severity": "Medium",
- "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.",
- "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
+ "severity": "Low",
+ "text": "For manual deployments, all configuration and deployments must be documented",
"waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
- "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
- "service": "SAP",
+ "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
+ "service": "AVS",
"services": [
- "Firewall",
- "WAF"
+ "WAF",
+ "AVS"
],
- "severity": "Medium",
- "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)",
- "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "severity": "Low",
+ "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
- "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
- "service": "SAP",
+ "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
+ "service": "AVS",
"services": [
- "SAP",
- "AppGW",
"WAF"
],
- "severity": "Medium",
- "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
- "waf": "Security"
+ "severity": "Low",
+ "text": "For automated deployments, deploy a minimal private cloud and scale as needed",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
+ "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
+ "service": "AVS",
"services": [
- "FrontDoor",
- "ACR",
- "AzurePolicy",
"WAF"
],
- "severity": "Medium",
- "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
- "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
- "waf": "Security"
+ "severity": "Low",
+ "text": "For automated deployments, request or reserve quota prior to starting the deployment",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
- "service": "SAP",
+ "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
+ "service": "AVS",
"services": [
- "FrontDoor",
- "AppGW",
- "AzurePolicy",
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
- "waf": "Security"
+ "severity": "Low",
+ "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "5ada4332-4e13-4811-9231-81aa41742694",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "SAP",
+ "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
+ "service": "AVS",
"services": [
- "LoadBalancer",
- "AppGW",
- "WAF"
+ "WAF",
+ "AKV"
],
- "severity": "Medium",
- "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.",
- "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "SAP",
+ "guid": "255461e2-aee3-4553-afc8-339248b262d6",
+ "service": "AVS",
"services": [
- "VWAN",
- "ACR",
- "SAP",
- "WAF"
+ "WAF",
+ "AVS",
+ "ExpressRoute",
+ "AKV"
],
- "severity": "Medium",
- "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
- "waf": "Performance"
+ "severity": "Low",
+ "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
- "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
- "service": "SAP",
+ "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
+ "service": "AVS",
"services": [
- "PrivateLink",
- "Backup",
- "Storage",
- "ACR",
- "VNet",
- "WAF"
+ "WAF",
+ "AVS"
],
- "severity": "Medium",
- "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.",
- "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
- "service": "SAP",
+ "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
+ "service": "AVS",
"services": [
- "SAP",
- "VM",
"WAF"
],
- "severity": "High",
- "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.",
- "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
- "waf": "Performance"
+ "severity": "Low",
+ "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
- "service": "SAP",
+ "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
+ "service": "AVS",
"services": [
- "LoadBalancer",
- "WAF"
+ "WAF",
+ "Subscriptions",
+ "AVS"
],
"severity": "Medium",
- "text": "Make sure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR). This setting (Enabling Floating IP) will reduce latency when internal load balancer configurations are used for high-availability configurations on the DBMS layer.",
- "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
- "waf": "Security"
+ "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution",
+ "waf": "Performance"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "6791f893-5ada-4433-84e1-3811523181aa",
- "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
- "service": "SAP",
+ "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
+ "service": "AVS",
"services": [
- "VM",
- "SAP",
- "VNet",
- "WAF"
+ "Storage",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.",
- "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
- "waf": "Security"
+ "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action",
+ "waf": "Performance"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
+ "service": "AVS",
"services": [
- "SAP",
- "VNet",
"WAF"
- ],
- "severity": "High",
- "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ ],
+ "severity": "Medium",
+ "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)",
"waf": "Performance"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
- "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
- "service": "SAP",
+ "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
+ "service": "AVS",
"services": [
- "SAP",
"WAF"
],
"severity": "Medium",
- "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.",
- "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
+ "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)",
"waf": "Performance"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
+ "service": "AVS",
"services": [
- "SAP",
"WAF"
],
- "severity": "High",
- "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "severity": "Medium",
+ "text": "Define and enforce scale in/out maximum limits for your environment in the automations",
"waf": "Performance"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
- "link": "https://me.sap.com/notes/2015553",
- "service": "SAP",
+ "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
+ "service": "AVS",
"services": [
- "SAP",
- "VNet",
- "Cost",
+ "Monitor",
"WAF"
],
- "severity": "High",
- "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "402a9846-d515-4061-aff8-cd30088693fa",
- "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
- "service": "SAP",
+ "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "AVS",
"services": [
- "LoadBalancer",
+ "VM",
"WAF"
],
"severity": "High",
- "text": "If using Load Balancer with Linux guest operating systems, check that the Linux network parameter net.ipv4.tcp_timestamps is set to 0.",
- "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
- "waf": "Performance"
+ "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
- "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
- "service": "SAP",
+ "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "AVS",
"services": [
- "SAP",
- "VNet",
"WAF"
],
- "severity": "Medium",
- "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering",
- "waf": "Security"
+ "severity": "High",
+ "text": "When using MON, you cannot enable MON on more than 100 Network extensions",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
- "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
- "service": "SAP",
+ "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
+ "service": "AVS",
"services": [
- "SAP",
- "Backup",
- "VM",
- "WAF"
+ "WAF",
+ "VPN"
],
- "severity": "High",
- "text": "Review SAP HANA database backups for Azure VMs.",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "If using a VPN connection for migrations, adjust your MTU size accordingly.",
+ "waf": "Performance"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
- "service": "SAP",
+ "guid": "e614658d-d457-4e92-9139-b821102cad6e",
+ "service": "AVS",
"services": [
- "SAP",
- "Monitor",
- "ASR",
"WAF"
],
"severity": "Medium",
- "text": "Review Site Recovery built-in monitoring, where used for SAP.",
- "waf": "Cost"
+ "text": "For low connectivity regions connecting into Azure (500Mbps or less), considering deploying the HCX WAN optimization appliance",
+ "waf": "Performance"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
- "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
- "service": "SAP",
+ "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
+ "service": "AVS",
"services": [
- "SAP",
- "Monitor",
"WAF"
],
- "severity": "High",
- "text": "Review the Monitoring the SAP HANA System Landscape guidance.",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Ensure that migrations are started from the on-premises appliance and NOT from the Cloud appliance (do NOT perform a reverse migration)",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
- "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
- "service": "SAP",
+ "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "service": "AVS",
"services": [
- "Backup",
"VM",
- "WAF"
+ "Storage",
+ "WAF",
+ "AVS"
],
"severity": "Medium",
- "text": "Review Oracle Database in Azure Linux VM backup strategies.",
- "waf": "Operations"
+ "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
- "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
- "service": "SAP",
+ "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
+ "service": "AVS",
"services": [
"Storage",
- "SQL",
- "WAF"
+ "WAF",
+ "ExpressRoute"
],
"severity": "Medium",
- "text": "Review the use of Azure Blob Storage with SQL Server 2016.",
- "waf": "Operations"
+ "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
- "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
- "service": "SAP",
+ "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
+ "service": "AVS",
"services": [
- "Backup",
- "VM",
- "WAF"
+ "Storage",
+ "WAF",
+ "ExpressRoute"
],
"severity": "Medium",
- "text": "Review the use of Automated Backup v2 for Azure VMs.",
- "waf": "Operations"
+ "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
- "service": "SAP",
+ "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "AVS",
"services": [
+ "ASR",
"WAF"
],
"severity": "High",
- "text": "Enabling Write accelerator for M series when using premium disks(V1)",
- "waf": "Operations"
+ "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
- "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
- "service": "SAP",
+ "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
+ "service": "AVS",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Test availability zone latency.",
- "waf": "Performance"
+ "severity": "High",
+ "text": "If using stretched cluster, ensure that the SLA provided will meet your requirements",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
- "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
- "service": "SAP",
+ "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
+ "service": "AVS",
"services": [
- "SAP",
- "WAF"
+ "WAF",
+ "ExpressRoute"
],
- "severity": "Medium",
- "text": "Activate SAP EarlyWatch Alert for all SAP components.",
- "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
- "waf": "Performance"
+ "severity": "High",
+ "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
- "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
- "service": "SAP",
+ "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "service": "AVS",
"services": [
- "SAP",
- "WAF"
+ "WAF",
+ "ExpressRoute"
],
- "severity": "Medium",
- "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.",
- "training": "https://me.sap.com/notes/0002879613",
- "waf": "Performance"
+ "severity": "High",
+ "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.AVS/privateClouds",
"checklist": "WAF checklist",
- "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
- "service": "SAP",
+ "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
+ "service": "AVS",
"services": [
- "Monitor",
- "SQL",
"WAF"
],
- "severity": "Medium",
- "text": "Review SQL Server performance monitoring using CCMS.",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Have site disaster tolerance settings been properly considered and changed for your business if needed.",
+ "waf": "Reliability"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
- "link": "https://me.sap.com/notes/500235",
- "service": "SAP",
+ "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.",
+ "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e",
+ "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention",
+ "service": "ACR",
"services": [
- "SAP",
- "VM",
+ "ACR",
"WAF"
],
- "severity": "Medium",
- "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).",
- "training": "https://me.sap.com/notes/1100926/E",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Disable Azure Container Registry image export",
+ "waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
- "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
- "service": "SAP",
+ "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry",
+ "guid": "d503547c-d447-4e82-9128-a7100f1cac6d",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy",
+ "service": "ACR",
"services": [
- "SAP",
- "Monitor",
- "WAF"
+ "ACR",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Review SAP HANA studio alerts.",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Enable Azure Policies for Azure Container Registry",
+ "waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
- "link": "https://me.sap.com/notes/1969700",
- "service": "SAP",
+ "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.",
+ "guid": "d345293c-7639-4637-a551-c5c04e401955",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push",
+ "service": "ACR",
"services": [
- "SAP",
- "WAF"
+ "ACR",
+ "WAF",
+ "AKV"
],
- "severity": "Medium",
- "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Sign and Verify containers with notation (Notary v2)",
+ "waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
+ "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.",
+ "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49",
+ "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys",
+ "service": "ACR",
"services": [
- "VM",
- "WAF"
+ "ACR",
+ "WAF",
+ "AKV"
],
"severity": "Medium",
- "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.",
- "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "text": "Encrypt registry with a customer managed key",
"waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "08951710-79a2-492a-adbc-06d7a401545b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
- "service": "SAP",
+ "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications",
+ "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
+ "service": "ACR",
"services": [
- "SAP",
+ "Entra",
+ "RBAC",
+ "ACR",
"WAF"
],
- "severity": "Medium",
- "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.",
- "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
+ "severity": "High",
+ "text": "Use Managed Identities to connect instead of Service Principals",
"waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
+ "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead",
+ "guid": "be0e38ce-e297-411b-b363-caaab79b198d",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
+ "service": "ACR",
"services": [
- "SAP",
- "SQL",
+ "RBAC",
"WAF"
],
- "severity": "Low",
- "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.",
+ "severity": "High",
+ "text": "Disable local authentication for management plane access",
"waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
- "service": "SAP",
+ "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations",
+ "guid": "387e5ced-126c-4d13-8af5-b20c6998a646",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli",
+ "service": "ACR",
"services": [
- "SQL",
+ "Entra",
+ "RBAC",
+ "ACR",
"WAF"
],
"severity": "High",
- "text": "Disable xp_cmdshell. The SQL Server feature xp_cmdshell enables a SQL Server internal operating system command shell. It's a potential risk in security audits.",
- "training": "https://me.sap.com/notes/3019299/E",
+ "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals",
"waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "description": "Disable anonymous pull/push access",
+ "guid": "e338997e-41c7-47d7-acf6-a62a1194956d",
+ "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access",
+ "service": "ACR",
"services": [
- "Backup",
- "SQL",
- "Storage",
- "SAP",
"WAF"
],
- "severity": "High",
- "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.",
- "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "severity": "Medium",
+ "text": "Disable Anonymous pull access",
"waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "SAP",
+ "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token",
+ "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli",
+ "service": "ACR",
"services": [
- "Storage",
+ "Entra",
"WAF"
],
- "severity": "Medium",
- "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.",
- "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
+ "severity": "High",
+ "text": "Disable repository-scoped access tokens",
"waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
- "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
- "service": "SAP",
+ "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network",
+ "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee",
+ "service": "ACR",
"services": [
- "AKV",
- "WAF"
+ "EventHubs",
+ "ACR",
+ "WAF",
+ "PrivateLink"
],
"severity": "High",
- "text": "Use Azure Key Vault to store your secrets and credentials",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "text": "Deploy images from a trusted environment",
"waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "SAP",
+ "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR",
+ "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy",
+ "service": "ACR",
"services": [
- "RBAC",
- "Subscriptions",
- "AzurePolicy",
- "WAF"
+ "Entra",
+ "ACR",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).",
- "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
+ "text": "Disable Azure ARM audience tokens for authentication",
"waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "SAP",
+ "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.",
+ "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6",
+ "link": "https://learn.microsoft.com/azure/container-registry/monitor-service",
+ "service": "ACR",
"services": [
- "AKV",
- "AzurePolicy",
+ "Entra",
+ "ACR",
+ "Monitor",
"WAF"
],
"severity": "Medium",
- "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "text": "Enable diagnostics logging",
"waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
- "service": "SAP",
+ "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch",
+ "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
+ "service": "ACR",
"services": [
- "RBAC",
- "AzurePolicy",
- "WAF"
+ "VNet",
+ "WAF",
+ "Firewall",
+ "PrivateLink"
],
- "severity": "High",
- "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed",
- "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
+ "severity": "Medium",
+ "text": "Control inbound network access with Private Link",
"waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "description": "Disable public network access if inbound network access is secured using Private Link",
+ "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access",
+ "service": "ACR",
"services": [
- "SAP",
- "Storage",
- "Defender",
- "WAF"
+ "WAF",
+ "PrivateLink"
],
- "severity": "High",
- "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.",
- "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
+ "severity": "Medium",
+ "text": "Disable Public Network access",
"waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
- "service": "SAP",
+ "description": "Only the ACR Premium SKU supports Private Link access",
+ "guid": "fc833934-8b26-42d6-ac5f-512925498f6d",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus",
+ "service": "ACR",
"services": [
- "SAP",
- "RBAC",
- "Defender",
- "WAF"
+ "ACR",
+ "WAF",
+ "PrivateLink"
],
- "severity": "High",
- "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.",
- "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "severity": "Medium",
+ "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)",
"waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities",
+ "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
+ "service": "ACR",
"services": [
- "SAP",
+ "Defender",
+ "ACR",
"WAF"
],
"severity": "Low",
- "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS",
- "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
+ "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities",
"waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
- "service": "SAP",
+ "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.",
+ "guid": "4451e1a2-d345-4293-a763-9637a551c5c0",
+ "service": "ACR",
"services": [
- "AKV",
"WAF"
],
"severity": "Medium",
- "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "text": "Deploy validated container images",
"waf": "Security"
},
{
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
- "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
- "service": "SAP",
+ "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.",
+ "guid": "4e401955-387e-45ce-b126-cd132af5b20c",
+ "service": "ACR",
"services": [
- "AKV",
"WAF"
],
"severity": "High",
- "text": "Use an Azure Key Vault per application per environment per region.",
- "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "text": "Use up-to-date platforms, languages, protocols and frameworks",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.BotService/botServices",
"checklist": "WAF checklist",
- "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
- "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
- "service": "SAP",
+ "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot",
+ "service": "Bot service",
"services": [
- "SAP",
- "AKV",
"WAF"
],
- "severity": "High",
- "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.",
- "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Follow reliability support recommendations in Azure Bot Service",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.BotService/botServices",
"checklist": "WAF checklist",
- "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
- "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
- "service": "SAP",
+ "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization",
+ "service": "Bot service",
"services": [
- "SAP",
- "RBAC",
- "Subscriptions",
"WAF"
],
- "severity": "High",
- "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes",
- "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Deploying bots with local data residency and regional compliance",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.BotService/botServices",
"checklist": "WAF checklist",
- "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
- "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
- "service": "SAP",
+ "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography",
+ "service": "Bot service",
"services": [
- "PrivateLink",
- "SAP",
- "NVA",
"WAF"
],
- "severity": "High",
- "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources",
- "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Azure Bot Service runs in active-active mode for both global and regional services. When an outage occurs, you don't need to detect errors or manage the service. Azure Bot Service automatically performs auto failover and auto recovery in a multi-region geographical architecture. For the EU bot regional service, Azure Bot Service provides two full regions inside Europe with active/active replication to ensure redundancy. For the global bot service, all available regions/geographies can be served as the global footprint.",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.ServiceBus/namespaces",
"checklist": "WAF checklist",
- "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
- "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
- "service": "SAP",
+ "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
+ "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
+ "service": "Service Bus",
"services": [
- "Storage",
- "VM",
+ "ServiceBus",
"WAF"
],
"severity": "Low",
- "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.",
- "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
+ "text": "Use customer-managed key option in data at rest encryption when required",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.ServiceBus/namespaces",
"checklist": "WAF checklist",
- "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
- "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
- "service": "SAP",
+ "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.",
+ "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
+ "service": "Service Bus",
"services": [
- "Defender",
+ "ServiceBus",
"WAF"
],
- "severity": "Low",
- "text": "For even more powerful protection, consider using Microsoft Defender for Endpoint.",
- "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
+ "severity": "Medium",
+ "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.ServiceBus/namespaces",
"checklist": "WAF checklist",
- "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
- "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
- "service": "SAP",
+ "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
+ "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
+ "service": "Service Bus",
"services": [
- "SAP",
- "VNet",
- "WAF"
+ "AzurePolicy",
+ "Entra",
+ "WAF",
+ "ServiceBus",
+ "RBAC",
+ "TrafficManager"
],
- "severity": "High",
- "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.",
- "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
+ "severity": "Medium",
+ "text": "Avoid using root account when it is not necessary",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.ServiceBus/namespaces",
"checklist": "WAF checklist",
- "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
- "service": "SAP",
+ "description": "A Service Bus client app running inside an Azure App Service application or in a virtual machine with enabled managed entities for Azure resources support does not need to handle SAS rules and keys, or any other access tokens. The client app only needs the endpoint address of the Service Bus Messaging namespace. ",
+ "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
+ "service": "Service Bus",
"services": [
- "SAP",
- "WAF"
+ "Storage",
+ "Entra",
+ "WAF",
+ "AKV",
+ "ServiceBus",
+ "VM",
+ "AppSvc"
],
- "severity": "Low",
- "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.",
- "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
+ "severity": "Medium",
+ "text": "When possible, your application should be using a managed identity to authenticate to Azure Service Bus. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "Security"
},
{
+ "arm-service": "Microsoft.ServiceBus/namespaces",
"checklist": "WAF checklist",
- "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
- "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
- "service": "SAP",
+ "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ",
+ "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
+ "service": "Service Bus",
+ "services": [
+ "Storage",
+ "WAF",
+ "Subscriptions",
+ "ServiceBus",
+ "RBAC"
+ ],
+ "severity": "High",
+ "text": "Use least privilege data plane RBAC",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.ServiceBus/namespaces",
+ "checklist": "WAF checklist",
+ "description": "Azure Service Bus resource logs include operational logs, virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.",
+ "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
+ "service": "Service Bus",
"services": [
- "SAP",
- "AKV",
"Monitor",
- "WAF"
+ "ServiceBus",
+ "WAF",
+ "VNet"
],
"severity": "Medium",
- "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.",
- "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
"checklist": "WAF checklist",
- "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298",
- "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies",
- "service": "Spring Apps",
+ "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
+ "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
+ "service": "Service Bus",
"services": [
- "WAF"
+ "ServiceBus",
+ "VNet",
+ "WAF",
+ "PrivateLink"
],
"severity": "Medium",
- "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions",
- "waf": "Reliability"
+ "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
+ "arm-service": "Microsoft.ServiceBus/namespaces",
"checklist": "WAF checklist",
- "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716",
- "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region",
- "service": "Spring Apps",
+ "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
+ "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
+ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
+ "service": "Service Bus",
"services": [
- "TrafficManager",
- "FrontDoor",
+ "ServiceBus",
"WAF"
],
"severity": "Medium",
- "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.",
- "waf": "Reliability"
+ "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef",
- "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps",
- "service": "Spring Apps",
+ "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
+ "service": "Azure Functions",
"services": [
- "ACR",
"WAF"
],
- "severity": "Medium",
- "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.",
+ "severity": "High",
+ "text": "Select the right Function hosting plan based on your business & SLO requirements",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066",
- "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment",
- "service": "Spring Apps",
+ "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans",
+ "service": "Azure Functions",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Use more than 1 app instance for your apps",
+ "severity": "High",
+ "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "guid": "7504c230-6035-4183-95a5-85762acc6075",
- "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services",
- "service": "Spring Apps",
+ "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Azure Functions",
"services": [
- "Monitor",
"WAF"
],
"severity": "Medium",
- "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway",
- "service": "Spring Apps",
+ "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "Azure Functions",
"services": [
- "WAF"
+ "WAF",
+ "AppSvc"
],
- "severity": "Medium",
- "text": "Set up autoscaling in Spring Cloud Gateway",
+ "severity": "High",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "guid": "97411607-b6fd-4335-99d1-9885faf4e392",
- "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale",
- "service": "Spring Apps",
+ "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
+ "service": "Azure Functions",
"services": [
- "WAF"
+ "WAF",
+ "AppSvc"
],
- "severity": "Low",
- "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.",
+ "severity": "High",
+ "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.AppPlatform/Spring",
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3",
- "link": "https://learn.microsoft.com/azure/spring-apps/overview",
- "service": "Spring Apps",
+ "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts",
+ "service": "Azure Functions",
"services": [
+ "Storage",
"WAF"
],
"severity": "Medium",
- "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.",
+ "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled",
"waf": "Reliability"
},
{
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
- "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
- "service": "Entra",
+ "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "Azure Functions",
"services": [
- "Entra",
"WAF"
],
"severity": "Medium",
- "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library",
- "waf": "Reliability"
+ "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code",
+ "waf": "Operations"
},
{
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
- "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
- "service": "AAD B2C",
+ "guid": "21c30d25-ffb7-4f6a-b9ea-b3fec328f787",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-cog_svcs_v1.docx",
+ "service": "Cognitive Services",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Make sure that your sign-in user flows are backed up and resilient. Make sure that the code that you use to sign-in your users are backed up and recoverable. Resilient interfaces with external processes",
+ "text": "Leverage FTA HandBook for Cognitive Services",
"waf": "Reliability"
},
{
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
- "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
- "service": "AAD B2C",
+ "guid": "78c34698-16b2-4763-aefe-1b9b599de0d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
+ "service": "Cognitive Services",
"services": [
- "WAF"
+ "WAF",
+ "Backup"
],
"severity": "Medium",
- "text": "Custom brand assets should be hosted on a CDN",
- "waf": "Performance"
+ "text": "Backup Your Prompts",
+ "waf": "Reliability"
},
{
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
- "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
- "service": "AAD B2C",
+ "guid": "750ab2ab-039d-4a6d-95d7-c892adb107d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
+ "service": "Cognitive Services",
"services": [
+ "ASR",
"WAF"
],
- "severity": "Low",
- "text": "Have multiple identiy providers (i.e., login with your microsoft, google, facebook accounts)",
+ "severity": "High",
+ "text": "Business Continuity and Disaster Recovery (BCDR) considerations with Azure OpenAI Service",
"waf": "Reliability"
},
{
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "guid": "325af625-ca44-4e46-a5e2-223ace8bb123",
+ "link": "https://github.com/abacaj/chatgpt-backup#backup-your-chatgpt-conversations",
+ "service": "Cognitive Services",
"services": [
- "VM",
- "WAF"
+ "WAF",
+ "Backup"
],
"severity": "Medium",
- "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)",
+ "text": "Backup Your ChatGPT conversations",
"waf": "Reliability"
},
{
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "guid": "07ca5f17-f154-4e3a-a369-2829e7e31618",
+ "link": "https://learn.microsoft.com/azure/ai-services/speech-service/how-to-custom-speech-continuous-integration-continuous-deployment",
+ "service": "Cognitive Services",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Don't replicate! Replication can create issues with directory synchronization",
+ "text": "CI/CD for custom speech",
"waf": "Reliability"
},
{
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
- "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
- "service": "Windows AD",
+ "guid": "3687a046-7a1f-4893-9bda-43324f248116",
+ "link": "https://learn.microsoft.com/azure/ai-services/qnamaker/tutorials/export-knowledge-base",
+ "service": "Cognitive Services",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Have active-active for multi-regions",
+ "severity": "Low",
+ "text": "Move a knowledge base using export-import",
"waf": "Reliability"
},
{
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
+ "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
+ "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
+ "service": "App Services",
"services": [
- "Entra",
"WAF"
],
- "severity": "Medium",
- "text": "Add Azure AD Domain service stamps to additional regions and locations",
+ "severity": "Low",
+ "text": "Refer to baseline highly available zone-redundant web application architecture for best practices",
"waf": "Reliability"
},
{
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
- "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
- "service": "Entra",
+ "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
"services": [
- "WAF"
+ "WAF",
+ "Backup"
],
"severity": "Medium",
- "text": "Use Replica Sets for DR",
+ "text": "Use Premium and Standard tiers. These tiers support staging slots and automated backups.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
- "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
- "service": "Service Bus",
+ "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service",
+ "service": "App Services",
"services": [
- "ServiceBus",
"WAF"
],
- "severity": "Low",
- "text": "Use customer-managed key option in data at rest encryption when required",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
- "waf": "Security"
+ "severity": "High",
+ "text": "Leverage Availability Zones where regionally applicable (requires Premium v2 or v3 tier)",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.",
- "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
- "service": "Service Bus",
+ "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
"services": [
- "ServiceBus",
"WAF"
],
"severity": "Medium",
- "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
- "waf": "Security"
+ "text": "Implement health checks",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
- "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
- "service": "Service Bus",
+ "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup",
+ "service": "App Services",
"services": [
- "Entra",
- "AzurePolicy",
- "TrafficManager",
- "RBAC",
- "ServiceBus",
- "WAF"
+ "WAF",
+ "AppSvc",
+ "Backup"
],
- "severity": "Medium",
- "text": "Avoid using root account when it is not necessary",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
- "waf": "Security"
+ "severity": "High",
+ "text": "Refer to backup and restore best practices for Azure App Service",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "description": "A Service Bus client app running inside an Azure App Service application or in a virtual machine with enabled managed entities for Azure resources support does not need to handle SAS rules and keys, or any other access tokens. The client app only needs the endpoint address of the Service Bus Messaging namespace. ",
- "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
- "service": "Service Bus",
+ "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
+ "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability",
+ "service": "App Services",
"services": [
- "Entra",
- "AKV",
- "Storage",
- "VM",
- "AppSvc",
- "ServiceBus",
- "WAF"
+ "WAF",
+ "AppSvc"
],
- "severity": "Medium",
- "text": "When possible, your application should be using a managed identity to authenticate to Azure Service Bus. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Security"
+ "severity": "High",
+ "text": "Implement Azure App Service reliability best practices",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ",
- "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
- "service": "Service Bus",
+ "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only",
+ "service": "App Services",
+ "services": [
+ "WAF",
+ "AppSvc"
+ ],
+ "severity": "Low",
+ "text": "Familiarize with how to move an App Service app to another region During a disaster",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.web/sites",
+ "checklist": "WAF checklist",
+ "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
+ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service",
+ "service": "App Services",
"services": [
- "Storage",
- "RBAC",
- "Subscriptions",
- "ServiceBus",
- "WAF"
+ "WAF",
+ "AppSvc"
],
"severity": "High",
- "text": "Use least privilege data plane RBAC",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
- "waf": "Security"
+ "text": "Familiarize with reliability support in Azure App Service",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "description": "Azure Service Bus resource logs include operational logs, virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.",
- "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
- "service": "Service Bus",
+ "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
+ "service": "App Services",
"services": [
- "Monitor",
- "VNet",
- "ServiceBus",
- "WAF"
+ "WAF",
+ "AppSvc"
],
"severity": "Medium",
- "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
- "waf": "Security"
+ "text": "Ensure \"Always On\" is enabled for Function Apps running on a app service plan",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
- "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
- "service": "Service Bus",
+ "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
+ "service": "App Services",
"services": [
- "PrivateLink",
- "ServiceBus",
- "VNet",
- "WAF"
+ "Monitor",
+ "WAF",
+ "AppSvc"
],
"severity": "Medium",
- "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
- "waf": "Security"
+ "text": "Monitor App Service instances using Health checks",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ServiceBus/namespaces",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
- "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
- "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
- "service": "Service Bus",
+ "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview",
+ "service": "App Services",
"services": [
- "ServiceBus",
+ "Monitor",
"WAF"
],
"severity": "Medium",
- "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Security"
+ "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
- "service": "APIM",
+ "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests",
+ "service": "App Services",
"services": [
- "AzurePolicy",
+ "Monitor",
"WAF"
],
- "severity": "Medium",
- "text": "Implement an error handling policy at the global level",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
- "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
- "service": "APIM",
+ "description": "Use Azure Key Vault to store any secrets the application needs. Key Vault provides a safe and audited environment for storing secrets and is well-integrated with App Service through the Key Vault SDK or App Service Key Vault References.",
+ "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
"services": [
- "AzurePolicy",
- "WAF"
+ "WAF",
+ "AKV",
+ "AppSvc"
],
- "severity": "Medium",
- "text": "Ensure all APIs policies include a element.",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use Key Vault to store secrets",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
- "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
- "service": "APIM",
+ "description": "Use a Managed Identity to connect to Key Vault either using the Key Vault SDK or through App Service Key Vault References.",
+ "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
+ "service": "App Services",
"services": [
- "ACR",
- "AzurePolicy",
- "WAF"
+ "Entra",
+ "WAF",
+ "AKV",
+ "AppSvc"
],
- "severity": "Medium",
- "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use Managed Identity to connect to Key Vault",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
- "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
- "service": "APIM",
+ "description": "Store the App Service TLS certificate in Key Vault.",
+ "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
+ "service": "App Services",
"services": [
- "WAF"
+ "WAF",
+ "AKV",
+ "AppSvc"
],
- "severity": "Medium",
- "text": "If you are planning to monetize your APIs, review the 'monetization support' article for best practices",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use Key Vault to store TLS certificate.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
- "service": "APIM",
+ "description": "Systems that process sensitive information should be isolated. To do so, use separate App Service Plans or App Service Environments and consider the use of different subscriptions or management groups.",
+ "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
+ "service": "App Services",
"services": [
- "Monitor",
- "WAF"
+ "WAF",
+ "Subscriptions",
+ "AppSvc"
],
- "severity": "High",
- "text": "Enable Diagnostics Settings to export logs to Azure Monitor",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Isolate systems that process sensitive information",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
- "service": "APIM",
+ "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those. (For example: D:\\\\Local and %TMP%).",
+ "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
+ "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
+ "service": "App Services",
"services": [
- "WAF"
+ "TrafficManager",
+ "WAF",
+ "AppSvc"
],
"severity": "Medium",
- "text": "Enable Application Insights for more detailed telemetry",
- "waf": "Operations"
+ "text": "Do not store sensitive data on local disk",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
- "service": "APIM",
+ "description": "For authenticated web application, use a well established Identity Provider like Azure AD or Azure AD B2C. Leverage the application framework of your choice to integrate with this provider or use the App Service Authentication / Authorization feature.",
+ "guid": "919ca0b2-c121-459e-814b-933df574eccc",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
+ "service": "App Services",
"services": [
- "Monitor",
- "WAF"
+ "Entra",
+ "WAF",
+ "AppSvc"
],
- "severity": "High",
- "text": "Configure alerts on the most critical metrics",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Use an established Identity Provider for authentication",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
- "service": "APIM",
+ "description": "Deploy code to App Service from a controlled and trusted environment, like a well-managed and secured DevOps deployment pipeline. This avoids code that was not version controlled and verified to be deployed from a malicious host.",
+ "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
+ "service": "App Services",
"services": [
- "AKV",
- "WAF"
+ "WAF",
+ "AppSvc"
],
"severity": "High",
- "text": "Ensure that custom SSL certificates are stored an Azure Key Vault so they can be securely accessed and updated",
+ "text": "Deploy from a trusted environment",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
- "service": "APIM",
+ "description": "Disable basic authentication for both FTP/FTPS and for WebDeploy/SCM. This disables access to these services and enforces the use of Azure AD secured endpoints for deployment. Note that the SCM site can also be opened using Azure AD credentials.",
+ "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
+ "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
+ "service": "App Services",
"services": [
"Entra",
"WAF"
],
"severity": "High",
- "text": "Protect incoming requests to APIs (data plane) with Azure AD",
+ "text": "Disable basic authentication",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
- "service": "APIM",
+ "description": "Where possible use Managed Identity to connect to Azure AD secured resources. If this is not possible, store secrets in Key Vault and connect to Key Vault using a Managed Identity instead.",
+ "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
+ "service": "App Services",
"services": [
"Entra",
- "WAF"
+ "WAF",
+ "AKV"
],
- "severity": "Medium",
- "text": "Use Microsoft Entra ID to authenticate users in the Developer Portal",
+ "severity": "High",
+ "text": "Use Managed Identity to connect to resources",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
- "service": "APIM",
+ "description": "Where using images stored in Azure Container Registry, pull these using a Managed Identity.",
+ "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
+ "service": "App Services",
"services": [
+ "Entra",
+ "ACR",
"WAF"
],
- "severity": "Medium",
- "text": "Create appropriate groups to control the visibility of the products",
+ "severity": "High",
+ "text": "Pull containers using a Managed Identity",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "06862505-2d9a-4874-9491-2837b00a3475",
- "link": "https://learn.microsoft.com/azure/api-management/backends",
- "service": "APIM",
+ "description": "By configuring the diagnostic settings of App Service, you can send all telemetry to Log Analytics as the central destination for logging and monitoring. This allows you to monitor runtime activity of App Service such as HTTP logs, application logs, platform logs, ...",
+ "guid": "47768314-c115-4775-a2ea-55b46ad48408",
+ "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
+ "service": "App Services",
"services": [
- "WAF"
+ "Monitor",
+ "WAF",
+ "AppSvc",
+ "Entra"
],
"severity": "Medium",
- "text": "Use Backends feature to eliminate redundant API backend configurations",
- "waf": "Operations"
+ "text": "Send App Service runtime logs to Log Analytics",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
- "service": "APIM",
+ "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.",
+ "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
+ "service": "App Services",
"services": [
- "AzurePolicy",
- "WAF"
+ "Monitor",
+ "WAF",
+ "AppSvc",
+ "Entra"
],
"severity": "Medium",
- "text": "Use Named Values to store common values that can be used in policies",
- "waf": "Operations"
+ "text": "Send App Service activity logs to Log Analytics",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
- "service": "APIM",
+ "description": "Control outbound network access using a combination of regional VNet integration, network security groups and UDR's. Traffic should be routed to an NVA such as Azure Firewall. Ensure to monitor the Firewall's logs.",
+ "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
+ "service": "App Services",
"services": [
- "ACR",
- "WAF"
+ "Monitor",
+ "NVA",
+ "VNet",
+ "WAF",
+ "Firewall"
],
"severity": "Medium",
- "text": "For DR, leverage the premium tier with deployments scaled across two or more regions for 99.99% SLA",
- "waf": "Reliability"
+ "text": "Outbound network access should be controlled",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
- "link": "https://learn.microsoft.com/azure/api-management/high-availability",
- "service": "APIM",
+ "description": "You can provide a stable outbound IP by using VNet integration and using a VNet NAT Gateway or an NVA like Azure Firewall. This allows the receiving party to allow-list based on IP, should that be needed. Note that for communications towards Azure Services often there's no need to depend on the IP address and mechanics like Service Endpoints should be used instead. (Also the use of private endpoints on the receiving end avoids for SNAT to happen and provides a stable outbound IP range.)",
+ "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
+ "service": "App Services",
"services": [
- "WAF"
+ "Storage",
+ "NVA",
+ "VNet",
+ "WAF",
+ "PrivateLink",
+ "Firewall"
],
- "severity": "Medium",
- "text": "Deploy at least one unit in two or more availability zones for an increased SLA of 99.99%",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Ensure a stable IP for outbound communications towards internet addresses",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
- "service": "APIM",
+ "description": "Control inbound network access using a combination of App Service Access Restrictions, Service Endpoints or Private Endpoints. Different access restrictions can be required and configured for the web app itself and the SCM site.",
+ "guid": "0725769e-e669-41a4-a34a-c932223ece80",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
"services": [
- "Backup",
- "WAF"
+ "WAF",
+ "AppSvc",
+ "PrivateLink"
],
"severity": "High",
- "text": "Ensure there is an automated backup routine",
- "waf": "Reliability"
+ "text": "Inbound network access should be controlled",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
- "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
- "service": "APIM",
+ "description": "Protect against malicious inbound traffic using a Web Application Firewall like Application Gateway or Azure Front Door. Make sure to monitor the WAF's logs.",
+ "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
+ "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
+ "service": "App Services",
"services": [
- "AzurePolicy",
- "WAF"
+ "Monitor",
+ "AppGW",
+ "WAF",
+ "FrontDoor",
+ "AppSvc"
],
- "severity": "Medium",
- "text": "Use Policies to add a fail-over backend URL and caching to reduce failing calls.",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Use a WAF in front of App Service",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
- "service": "APIM",
+ "description": "Make sure the WAF cannot be bypassed by locking down access to only the WAF. Use a combination of Access Restrictions, Service Endpoints and Private Endpoints.",
+ "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
+ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
+ "service": "App Services",
"services": [
- "EventHubs",
- "AzurePolicy",
- "WAF"
+ "WAF",
+ "PrivateLink"
],
- "severity": "Low",
- "text": "If you need to log at high performance levels, consider Event Hubs policy",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Avoid for WAF to be bypassed",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
- "service": "APIM",
+ "description": "Set minimum TLS policy to 1.2 in App Service configuration.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
+ "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
+ "service": "App Services",
"services": [
- "AzurePolicy",
- "WAF"
+ "WAF",
+ "AppSvc",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Apply throttling policies to control the number of requests per second",
- "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
- "waf": "Performance"
+ "text": "Set minimum TLS policy to 1.2",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
- "service": "APIM",
+ "description": "Configure App Service to use HTTPS only. This causes App Service to redirect from HTTP to HTTPS. Strongly consider the use of HTTP Strict Transport Security (HSTS) in your code or from your WAF, which informs browsers that the site should only be accessed using HTTPS.",
+ "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
+ "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
+ "service": "App Services",
"services": [
- "WAF"
+ "WAF",
+ "AppSvc"
],
- "severity": "Medium",
- "text": "Configure autoscaling to scale out the number of instances when the load increases",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Use HTTPS only",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
- "service": "APIM",
+ "description": "Do not use wildcards in your CORS configuration, as this allows all origins to access the service (thereby defeating the purpose of CORS). Specifically only allow the origins that you expect to be able to access the service.",
+ "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
+ "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
+ "service": "App Services",
"services": [
+ "Storage",
"WAF"
],
- "severity": "Medium",
- "text": "Deploy self-hosted gateways where Azure doesn't have a region close to the backend APIs.",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Wildcards must not be used for CORS",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
- "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
- "service": "APIM",
+ "description": "Remote debugging must not be turned on in production as this opens additional ports on the service which increases the attack surface. Note that the service does turn of remote debugging automatically after 48 hours.",
+ "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
+ "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
+ "service": "App Services",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Use the premium tier for production workloads.",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Turn off remote debugging",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
- "service": "APIM",
+ "description": "Enable Defender for App Service. This (amongst other threats) detects communications to known malicious IP addresses. Review the recommendations from Defender for App Service as part of your operations.",
+ "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
+ "service": "App Services",
"services": [
- "AzurePolicy",
- "WAF"
+ "Defender",
+ "WAF",
+ "AppSvc"
],
"severity": "Medium",
- "text": "In multi-region model, use Policies to route the requests to regional backends based on availability or latency.",
- "waf": "Reliability"
+ "text": "Enable Defender for Cloud - Defender for App Service",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
- "service": "APIM",
+ "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.",
+ "guid": "223ece80-b123-4071-a541-6415833ea3ad",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "App Services",
"services": [
- "Entra",
- "APIM",
- "WAF"
+ "EventHubs",
+ "AppGW",
+ "VNet",
+ "WAF",
+ "NVA",
+ "DDoS"
],
- "severity": "High",
- "text": "Be aware of APIM's limits",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Enable DDOS Protection Standard on the WAF VNet",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
- "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
- "service": "APIM",
+ "description": "Where using images stored in Azure Container Registry, pull these over a virtual network from Azure Container Registry using its private endpoint and the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'.",
+ "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
+ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
+ "service": "App Services",
"services": [
- "WAF"
+ "VNet",
+ "ACR",
+ "WAF",
+ "PrivateLink"
],
- "severity": "High",
- "text": "Ensure that the self-hosted gateway deployments are resilient.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Pull containers over a Virtual Network",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "7519e385-a88b-4d34-966b-6269d686e890",
- "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
- "service": "APIM",
+ "description": "Conduct a penetration test on the web application following the penetration testing rules of engagement.",
+ "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
+ "service": "App Services",
"services": [
- "Entra",
- "APIM",
- "FrontDoor",
"WAF"
],
"severity": "Medium",
- "text": "Use Azure Front Door in front of APIM for multi-region deployment",
- "waf": "Performance"
+ "text": "Conduct a penetration test",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
- "service": "APIM",
+ "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.",
+ "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
+ "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
+ "service": "App Services",
"services": [
- "VNet",
"WAF"
],
"severity": "Medium",
- "text": "Deploy the service within a Virtual Network (VNet)",
+ "text": "Deploy validated code",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "microsoft.web/sites",
"checklist": "WAF checklist",
- "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
- "service": "APIM",
+ "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.",
+ "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
+ "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
+ "service": "App Services",
"services": [
- "Entra",
- "APIM",
- "Monitor",
- "VNet",
"WAF"
],
- "severity": "Medium",
- "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic to/from APIM.",
+ "severity": "High",
+ "text": "Use up-to-date platforms, languages, protocols and frameworks",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
- "service": "APIM",
+ "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
"services": [
- "Entra",
- "PrivateLink",
- "APIM",
- "VNet",
+ "Storage",
"WAF"
],
"severity": "Medium",
- "text": "Deploy Private Endpoints to filter incoming traffic when APIM is not deployed to a VNet.",
+ "text": "Consider the 'Azure security baseline for storage'",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
- "service": "APIM",
+ "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Storage",
+ "WAF",
+ "PrivateLink"
],
"severity": "High",
- "text": "Disable Public Network Access",
+ "text": "Consider using private endpoints for Azure Storage",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
- "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
- "service": "APIM",
+ "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "RBAC",
+ "Storage",
+ "WAF",
+ "Subscriptions"
],
"severity": "Medium",
- "text": "Simplify management with PowerShell automation scripts",
- "waf": "Operations"
+ "text": "Ensure older storage accounts are not using 'classic deployment model'",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
- "service": "APIM",
+ "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
"services": [
- "Entra",
- "APIM",
+ "Defender",
+ "Storage",
"WAF"
],
- "severity": "Medium",
- "text": "Configure APIM via Infrastructure-as-code. Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Enable Microsoft Defender for all of your storage accounts",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
- "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
- "service": "APIM",
+ "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
"services": [
- "Entra",
- "APIM",
+ "Storage",
"WAF"
],
"severity": "Medium",
- "text": "Promote usage of Visual Studio Code APIM extension for faster API development",
- "waf": "Operations"
+ "text": "Enable 'soft delete' for blobs",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
- "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
- "service": "APIM",
+ "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
"services": [
+ "Storage",
"WAF"
],
"severity": "Medium",
- "text": "Implement DevOps and CI/CD in your workflow",
- "waf": "Operations"
+ "text": "Disable 'soft delete' for blobs",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "b6439493-426a-45f3-9697-cf65baee208d",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
- "service": "APIM",
+ "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Secure APIs using client certificate authentication",
+ "severity": "High",
+ "text": "Enable 'soft delete' for containers",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "2a67d143-1033-4c0a-8732-680896478f08",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
- "service": "APIM",
+ "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
"services": [
+ "Storage",
"WAF"
],
"severity": "Medium",
- "text": "Secure backend services using client certificate authentication",
+ "text": "Disable 'soft delete' for containers",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
- "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
- "service": "APIM",
+ "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
"services": [
+ "Storage",
"WAF"
],
- "severity": "Medium",
- "text": "Review 'Recommendations to mitigate OWASP API Security Top 10 threats' article and check what is applicable to your APIs",
+ "severity": "High",
+ "text": "Enable resource locks on storage accounts",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
- "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
- "service": "APIM",
+ "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Storage",
+ "WAF",
+ "Subscriptions",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs",
+ "severity": "High",
+ "text": "Consider immutable blobs",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
- "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
- "service": "APIM",
+ "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
"services": [
+ "Storage",
"WAF"
],
"severity": "High",
- "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.",
+ "text": "Require HTTPS, i.e. disable port 80 on the storage account",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "f8af3d94-1d2b-4070-846f-849197524258",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
- "service": "APIM",
+ "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
"services": [
- "AKV",
+ "Storage",
"WAF"
],
"severity": "High",
- "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated",
+ "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "791abd8b-7706-4e31-9569-afefde724be3",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
- "service": "APIM",
+ "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
"services": [
- "Entra",
+ "Storage",
"WAF"
],
"severity": "Medium",
- "text": "Use managed identities to authenticate to other Azure resources whenever possible",
+ "text": "Limit shared access signature (SAS) tokens to HTTPS connections only",
"waf": "Security"
},
{
- "arm-service": "Microsoft.ApiManagement/service",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
- "service": "APIM",
+ "description": "AAD tokens should be favored over shared access signatures, wherever possible",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
"services": [
"Entra",
- "APIM",
- "AppGW",
+ "Storage",
"WAF"
],
"severity": "High",
- "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM",
+ "text": "Use Azure Active Directory (Azure AD) tokens for blob access",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421",
- "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations",
- "service": "App Services",
+ "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
"services": [
+ "RBAC",
"WAF"
],
- "severity": "Low",
- "text": "Refer to baseline highly available zone-redundant web application architecture for best practices",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Least privilege in IaM permissions",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans",
- "service": "App Services",
+ "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
"services": [
- "Backup",
+ "Entra",
+ "Storage",
"WAF"
],
- "severity": "Medium",
- "text": "Use Premium and Standard tiers. These tiers support staging slots and automated backups.",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service",
- "service": "App Services",
+ "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on AAD authentication makes it easier to tie storage access to a user. ",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Monitor",
+ "Storage",
+ "Entra",
+ "WAF",
+ "AKV"
],
"severity": "High",
- "text": "Leverage Availability Zones where regionally applicable (requires Premium v2 or v3 tier)",
- "waf": "Reliability"
+ "text": "Consider disabling storage account keys, so that only AAD access (and user delegation SAS) is supported.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
+ "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
"services": [
- "WAF"
+ "Monitor",
+ "Storage",
+ "AzurePolicy",
+ "WAF",
+ "AKV"
+ ],
+ "severity": "High",
+ "text": "Consider using Azure Monitor to audit control plane operations on the storage account",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
+ "services": [
+ "Storage",
+ "WAF",
+ "AKV",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Implement health checks",
- "waf": "Reliability"
+ "text": "When using storage account keys, consider enabling a 'key expiration policy'",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup",
- "service": "App Services",
+ "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
"services": [
- "AppSvc",
- "Backup",
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Refer to backup and restore best practices for Azure App Service",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Consider configuring an SAS expiration policy",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2",
- "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability",
- "service": "App Services",
+ "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
"services": [
- "AppSvc",
- "WAF"
+ "Storage",
+ "WAF",
+ "AKV",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Implement Azure App Service reliability best practices",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Consider linking SAS to a stored access policy",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only",
- "service": "App Services",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
"services": [
- "AppSvc",
- "WAF"
+ "Storage",
+ "WAF",
+ "AKV"
],
- "severity": "Low",
- "text": "Familiarize with how to move an App Service app to another region During a disaster",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293",
- "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service",
- "service": "App Services",
+ "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
"services": [
- "AppSvc",
+ "Entra",
+ "Storage",
"WAF"
],
"severity": "High",
- "text": "Familiarize with reliability support in Azure App Service",
- "waf": "Reliability"
+ "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e",
- "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on",
- "service": "App Services",
+ "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
"services": [
- "AppSvc",
- "WAF"
+ "Storage",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Ensure \"Always On\" is enabled for Function Apps running on a app service plan",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Strive for short validity periods for ad-hoc SAS",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab",
- "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check",
- "service": "App Services",
+ "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
"services": [
- "AppSvc",
- "Monitor",
"WAF"
],
"severity": "Medium",
- "text": "Monitor App Service instances using Health checks",
- "waf": "Reliability"
+ "text": "Apply a narrow scope to a SAS",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview",
- "service": "App Services",
+ "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
"services": [
- "Monitor",
"WAF"
],
"severity": "Medium",
- "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests",
- "waf": "Reliability"
+ "text": "Consider scoping SAS to a specific client IP address, wherever possible",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea",
- "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests",
- "service": "App Services",
+ "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
"services": [
- "Monitor",
+ "Storage",
"WAF"
],
"severity": "Low",
- "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website",
- "waf": "Reliability"
+ "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "WAF checklist",
+ "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
+ "services": [
+ "Entra",
+ "RBAC",
+ "Storage",
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Use Azure Key Vault to store any secrets the application needs. Key Vault provides a safe and audited environment for storing secrets and is well-integrated with App Service through the Key Vault SDK or App Service Key Vault References.",
- "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
"services": [
- "AKV",
- "AppSvc",
"WAF"
],
- "severity": "High",
- "text": "Use Key Vault to store secrets",
+ "severity": "Medium",
+ "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Use a Managed Identity to connect to Key Vault either using the Key Vault SDK or through App Service Key Vault References.",
- "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
- "service": "App Services",
+ "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
"services": [
- "Entra",
- "AKV",
- "AppSvc",
- "WAF"
+ "Storage",
+ "WAF",
+ "AzurePolicy"
],
"severity": "High",
- "text": "Use Managed Identity to connect to Key Vault",
+ "text": "Avoid overly broad CORS policies",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Store the App Service TLS certificate in Key Vault.",
- "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
- "service": "App Services",
+ "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
"services": [
- "AKV",
- "AppSvc",
+ "Storage",
"WAF"
],
"severity": "High",
- "text": "Use Key Vault to store TLS certificate.",
+ "text": "Determine how data at rest should be encrypted. Understand the thread model for data.",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Systems that process sensitive information should be isolated. To do so, use separate App Service Plans or App Service Environments and consider the use of different subscriptions or management groups.",
- "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
- "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
- "service": "App Services",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
"services": [
- "AppSvc",
- "Subscriptions",
"WAF"
],
"severity": "Medium",
- "text": "Isolate systems that process sensitive information",
+ "text": "Determine which/if platform encryption should be used.",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those. (For example: D:\\\\Local and %TMP%).",
- "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
- "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
- "service": "App Services",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
"services": [
- "AppSvc",
- "TrafficManager",
"WAF"
],
"severity": "Medium",
- "text": "Do not store sensitive data on local disk",
+ "text": "Determine which/if client-side encryption should be used.",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "For authenticated web application, use a well established Identity Provider like Azure AD or Azure AD B2C. Leverage the application framework of your choice to integrate with this provider or use the App Service Authentication / Authorization feature.",
- "guid": "919ca0b2-c121-459e-814b-933df574eccc",
- "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
- "service": "App Services",
+ "description": "Leverage Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) to find storage accounts which allow anonymous blob access.",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
"services": [
- "Entra",
- "AppSvc",
+ "Storage",
"WAF"
],
- "severity": "Medium",
- "text": "Use an established Identity Provider for authentication",
+ "severity": "High",
+ "text": "Consider whether public blob access is needed, or whether it can be disabled for certain storage accounts. ",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Deploy code to App Service from a controlled and trusted environment, like a well-managed and secured DevOps deployment pipeline. This avoids code that was not version controlled and verified to be deployed from a malicious host.",
- "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
- "service": "App Services",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
"services": [
- "AppSvc",
+ "Storage",
"WAF"
],
"severity": "High",
- "text": "Deploy from a trusted environment",
- "waf": "Security"
+ "text": "Leverage a storagev2 account type for better performance and reliability",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Disable basic authentication for both FTP/FTPS and for WebDeploy/SCM. This disables access to these services and enforces the use of Azure AD secured endpoints for deployment. Note that the SCM site can also be opened using Azure AD credentials.",
- "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
- "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
- "service": "App Services",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
"services": [
- "Entra",
+ "Storage",
"WAF"
],
"severity": "High",
- "text": "Disable basic authentication",
- "waf": "Security"
+ "text": "Leverage GRS, ZRS or GZRS storage for the highest availability",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Where possible use Managed Identity to connect to Azure AD secured resources. If this is not possible, store secrets in Key Vault and connect to Key Vault using a Managed Identity instead.",
- "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
- "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
- "service": "App Services",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
"services": [
- "Entra",
- "AKV",
"WAF"
],
- "severity": "High",
- "text": "Use Managed Identity to connect to resources",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "For write operation after failover, use customer-Managed Failover ",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Where using images stored in Azure Container Registry, pull these using a Managed Identity.",
- "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
- "service": "App Services",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
"services": [
- "Entra",
- "ACR",
"WAF"
],
- "severity": "High",
- "text": "Pull containers using a Managed Identity",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Understand Microsoft-Managed Failover details",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "By configuring the diagnostic settings of App Service, you can send all telemetry to Log Analytics as the central destination for logging and monitoring. This allows you to monitor runtime activity of App Service such as HTTP logs, application logs, platform logs, ...",
- "guid": "47768314-c115-4775-a2ea-55b46ad48408",
- "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
- "service": "App Services",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
"services": [
- "Entra",
- "AppSvc",
- "Monitor",
"WAF"
],
"severity": "Medium",
- "text": "Send App Service runtime logs to Log Analytics",
+ "text": "Enable Soft Delete",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "WAF checklist",
+ "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
+ "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
+ "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
+ "service": "Event Hubs",
+ "services": [
+ "EventHubs",
+ "WAF"
+ ],
+ "severity": "Low",
+ "text": "Use customer-managed key option in data at rest encryption when required",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "microsoft.eventhub/namespaces",
"checklist": "WAF checklist",
- "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.",
- "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
- "service": "App Services",
+ "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ",
+ "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
+ "service": "Event Hubs",
"services": [
- "Entra",
- "AppSvc",
- "Monitor",
+ "EventHubs",
"WAF"
],
"severity": "Medium",
- "text": "Send App Service activity logs to Log Analytics",
+ "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "microsoft.eventhub/namespaces",
"checklist": "WAF checklist",
- "description": "Control outbound network access using a combination of regional VNet integration, network security groups and UDR's. Traffic should be routed to an NVA such as Azure Firewall. Ensure to monitor the Firewall's logs.",
- "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
- "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
- "service": "App Services",
+ "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It�s recommended that you treat this rule like an administrative root account and don�t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
+ "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
+ "service": "Event Hubs",
"services": [
- "NVA",
- "Monitor",
- "VNet",
- "Firewall",
- "WAF"
+ "EventHubs",
+ "AzurePolicy",
+ "Entra",
+ "WAF",
+ "RBAC",
+ "TrafficManager"
],
"severity": "Medium",
- "text": "Outbound network access should be controlled",
+ "text": "Avoid using root account when it is not necessary",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "microsoft.eventhub/namespaces",
"checklist": "WAF checklist",
- "description": "You can provide a stable outbound IP by using VNet integration and using a VNet NAT Gateway or an NVA like Azure Firewall. This allows the receiving party to allow-list based on IP, should that be needed. Note that for communications towards Azure Services often there's no need to depend on the IP address and mechanics like Service Endpoints should be used instead. (Also the use of private endpoints on the receiving end avoids for SNAT to happen and provides a stable outbound IP range.)",
- "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
- "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
- "service": "App Services",
+ "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ",
+ "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
+ "service": "Event Hubs",
"services": [
- "PrivateLink",
+ "EventHubs",
"Storage",
- "NVA",
- "VNet",
- "Firewall",
- "WAF"
+ "Entra",
+ "WAF",
+ "AKV",
+ "VM"
],
- "severity": "Low",
- "text": "Ensure a stable IP for outbound communications towards internet addresses",
+ "severity": "Medium",
+ "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "microsoft.eventhub/namespaces",
"checklist": "WAF checklist",
- "description": "Control inbound network access using a combination of App Service Access Restrictions, Service Endpoints or Private Endpoints. Different access restrictions can be required and configured for the web app itself and the SCM site.",
- "guid": "0725769e-e669-41a4-a34a-c932223ece80",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
+ "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.",
+ "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
+ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
+ "service": "Event Hubs",
"services": [
- "PrivateLink",
- "AppSvc",
+ "EventHubs",
+ "RBAC",
"WAF"
],
"severity": "High",
- "text": "Inbound network access should be controlled",
+ "text": "Use least privilege data plane RBAC",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "microsoft.eventhub/namespaces",
"checklist": "WAF checklist",
- "description": "Protect against malicious inbound traffic using a Web Application Firewall like Application Gateway or Azure Front Door. Make sure to monitor the WAF's logs.",
- "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
- "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
- "service": "App Services",
+ "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.",
+ "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
+ "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
+ "service": "Event Hubs",
"services": [
- "AppGW",
- "FrontDoor",
"Monitor",
- "AppSvc",
- "WAF"
+ "EventHubs",
+ "WAF",
+ "VNet"
],
- "severity": "High",
- "text": "Use a WAF in front of App Service",
+ "severity": "Medium",
+ "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "microsoft.eventhub/namespaces",
"checklist": "WAF checklist",
- "description": "Make sure the WAF cannot be bypassed by locking down access to only the WAF. Use a combination of Access Restrictions, Service Endpoints and Private Endpoints.",
- "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
- "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
- "service": "App Services",
+ "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
+ "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
+ "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
+ "service": "Event Hubs",
"services": [
- "PrivateLink",
- "WAF"
+ "VNet",
+ "EventHubs",
+ "WAF",
+ "PrivateLink"
],
- "severity": "High",
- "text": "Avoid for WAF to be bypassed",
+ "severity": "Medium",
+ "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "microsoft.eventhub/namespaces",
"checklist": "WAF checklist",
- "description": "Set minimum TLS policy to 1.2 in App Service configuration.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
- "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
- "service": "App Services",
+ "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
+ "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
+ "service": "Event Hubs",
"services": [
- "AppSvc",
- "AzurePolicy",
+ "EventHubs",
"WAF"
],
"severity": "Medium",
- "text": "Set minimum TLS policy to 1.2",
+ "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "microsoft.eventhub/namespaces",
"checklist": "WAF checklist",
- "description": "Configure App Service to use HTTPS only. This causes App Service to redirect from HTTP to HTTPS. Strongly consider the use of HTTP Strict Transport Security (HSTS) in your code or from your WAF, which informs browsers that the site should only be accessed using HTTPS.",
- "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
- "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
- "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
- "service": "App Services",
+ "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
+ "service": "Event Hubs",
"services": [
- "AppSvc",
"WAF"
],
- "severity": "High",
- "text": "Use HTTPS only",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Leverage FTA Resillency HandBook",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "microsoft.eventhub/namespaces",
"checklist": "WAF checklist",
- "description": "Do not use wildcards in your CORS configuration, as this allows all origins to access the service (thereby defeating the purpose of CORS). Specifically only allow the origins that you expect to be able to access the service.",
- "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
- "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
- "service": "App Services",
+ "description": " This will be turned on automatically for a new EH namespace created from the portal with Premium, Dedicated, or Standard SKUs in a zone-enabled region. Both the EH metadata and the event data itself are replicated across zones",
+ "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
+ "service": "Event Hubs",
"services": [
- "Storage",
+ "EventHubs",
+ "ACR",
"WAF"
],
"severity": "High",
- "text": "Wildcards must not be used for CORS",
- "waf": "Security"
+ "text": "Leverage Availability Zones if regionally applicable",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "microsoft.eventhub/namespaces",
"checklist": "WAF checklist",
- "description": "Remote debugging must not be turned on in production as this opens additional ports on the service which increases the attack surface. Note that the service does turn of remote debugging automatically after 48 hours.",
- "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
- "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
- "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
- "service": "App Services",
+ "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
+ "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
+ "service": "Event Hubs",
+ "services": [
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "Use the Premium or Dedicated SKUs for predicable performance",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.eventhub/namespaces",
+ "checklist": "WAF checklist",
+ "description": "The built-in geo-disaster recovery feature, when enabled, ensures that the entire configuration of anamespace (Event Hubs, Consumer Groups and settings) is continuously replicated from a primary namespace to a secondary namespace, and it allows a once-only failover move from the primary to the secondary at any time. Active/Passive feature is designed to make it easier to recover from and abandon a failed Azure region without having to change application configurations",
+ "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
+ "service": "Event Hubs",
"services": [
+ "EventHubs",
+ "ASR",
"WAF"
],
"severity": "High",
- "text": "Turn off remote debugging",
- "waf": "Security"
+ "text": "Plan for Geo Disaster Recovery using Active Passive configuration",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "microsoft.eventhub/namespaces",
"checklist": "WAF checklist",
- "description": "Enable Defender for App Service. This (amongst other threats) detects communications to known malicious IP addresses. Review the recommendations from Defender for App Service as part of your operations.",
- "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
- "service": "App Services",
+ "description": "Should be used for DR configurations where an outage or loss of event data in the downed region cannot be tolerated. For these cases, follow the replication guidance and do not use the built-in geo-disaster recovery capability (active/passive). With Active/Active, Maintain multiple Event Hubs in different regions and namespaces, and events will be replicated between the hubs",
+ "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
+ "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
+ "service": "Event Hubs",
"services": [
- "AppSvc",
- "Defender",
+ "EventHubs",
+ "ASR",
"WAF"
],
"severity": "Medium",
- "text": "Enable Defender for Cloud - Defender for App Service",
- "waf": "Security"
+ "text": "For Business Critical Applications, use Active Active configuration",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "microsoft.eventhub/namespaces",
"checklist": "WAF checklist",
- "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.",
- "guid": "223ece80-b123-4071-a541-6415833ea3ad",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "App Services",
+ "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
+ "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
+ "service": "Event Hubs",
"services": [
- "AppGW",
- "DDoS",
- "NVA",
"EventHubs",
- "VNet",
"WAF"
],
"severity": "Medium",
- "text": "Enable DDOS Protection Standard on the WAF VNet",
- "waf": "Security"
+ "text": "Design Resilient Event Hubs",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "description": "Where using images stored in Azure Container Registry, pull these over a virtual network from Azure Container Registry using its private endpoint and the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'.",
- "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
- "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
- "service": "App Services",
+ "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Front Door",
"services": [
- "PrivateLink",
- "ACR",
- "VNet",
+ "WAF",
+ "FrontDoor",
+ "AKV"
+ ],
+ "severity": "Medium",
+ "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
+ "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "App Gateway",
+ "services": [
+ "AppGW",
"WAF"
],
"severity": "Medium",
- "text": "Pull containers over a Virtual Network",
+ "text": "Ensure you are using Application Gateway v2 SKU",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Network/loadBalancers",
"checklist": "WAF checklist",
- "description": "Conduct a penetration test on the web application following the penetration testing rules of engagement.",
- "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
- "service": "App Services",
+ "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
+ "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Load Balancer",
"services": [
- "WAF"
+ "WAF",
+ "LoadBalancer"
],
"severity": "Medium",
- "text": "Conduct a penetration test",
+ "text": "Ensure you are using the Standard SKU for your Azure Load Balancers",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "Microsoft.Network/loadBalancers",
"checklist": "WAF checklist",
- "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.",
- "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
- "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
- "service": "App Services",
+ "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
+ "service": "Load Balancer",
"services": [
- "WAF"
+ "WAF",
+ "LoadBalancer"
],
"severity": "Medium",
- "text": "Deploy validated code",
+ "text": "Ensure your Load Balancers frontend IP addresses are zone-redundant (unless you require zonal frontends).",
"waf": "Security"
},
{
- "arm-service": "microsoft.web/sites",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.",
- "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
- "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
- "service": "App Services",
+ "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
+ "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "App Gateway",
"services": [
+ "VNet",
+ "AppGW",
"WAF"
],
- "severity": "High",
- "text": "Use up-to-date platforms, languages, protocols and frameworks",
+ "severity": "Medium",
+ "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Security"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
- "service": "Azure MySQL",
+ "description": "Administration of reverse proxies in general and WAF in particular is closer to the application than to networking, so they belong in the same subscription as the app. Centralizing the Application Gateway and WAF in the connectivity subscription might be OK if it is managed by one single team.",
+ "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "App Gateway",
"services": [
- "WAF"
+ "Entra",
+ "AppGW",
+ "VNet",
+ "WAF",
+ "NVA",
+ "Subscriptions"
],
"severity": "Medium",
- "text": "Leverage Flexible Server",
- "waf": "Reliability"
+ "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
- "service": "Azure MySQL",
+ "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "App Gateway",
"services": [
- "WAF"
+ "WAF",
+ "DDoS"
],
- "severity": "High",
- "text": "Leverage Availability Zones where regionally applicable",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.DBforMySQL/servers",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
- "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
- "service": "Azure MySQL",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
+ "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
+ "service": "App Gateway",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Leverage Data-in replication for cross-region DR scenarios",
+ "text": "Configure autoscaling with a minimum amount of instances of two.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "description": "Using the correct approach to feed a datalake with cold data and having the Kusto query engine at your disposal at the same time, as in the short-term storage",
- "guid": "ba7da7be-9951-4914-a384-5d997cb39132",
- "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export",
- "service": "Azure Data Explorer",
+ "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
+ "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
+ "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
+ "service": "App Gateway",
"services": [
- "Storage",
- "Cost",
+ "ACR",
+ "AppGW",
"WAF"
],
- "text": "Leverage External Tables and Continuous data export overview to reduce costs",
+ "severity": "Medium",
+ "text": "Deploy Application Gateway across Availability Zones",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "description": "Azure Data Explorer provides an optional follower capability for a leader cluster to be followed by other follower clusters for read-only access to the leader's data and metadata. Changes in the leader, such as create, append, and drop are automatically synchronized to the follower. While the leaders could span Azure regions, the follower clusters should be hosted in the same region(s) as the leader. If the leader cluster is down or databases or tables are accidentally dropped, the follower clusters will lose access until access is recovered in the leader.",
- "guid": "56a22586-f490-4641-addd-ea8a377cdeb3",
- "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp",
- "service": "Azure Data Explorer",
+ "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "Front Door",
"services": [
- "Storage",
- "WAF"
+ "WAF",
+ "FrontDoor",
+ "AzurePolicy"
],
- "text": "To share data, explore Leader-follower cluster configuration",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "description": "Azure Data Explorer doesn't support automatic protection against the outage of an entire Azure region. This disruption can happen during a natural disaster, like an earthquake. If you require a solution for a disaster recovery situation, do the following steps to ensure business continuity. In these steps, you'll replicate your clusters, management, and data ingestion in two Azure paired regions.",
- "guid": "861bb2bc-14ae-4a6e-95d8-d9a3adc218e6",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters",
- "service": "Azure Data Explorer",
+ "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "Front Door",
"services": [
- "ASR",
- "WAF"
+ "AppGW",
+ "WAF",
+ "FrontDoor",
+ "AzurePolicy"
],
- "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
+ "ammp": true,
+ "arm-service": "microsoft.network/trafficManagerProfiles",
"checklist": "WAF checklist",
- "guid": "436b0635-cb45-4e57-a603-324ace8cc123",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities",
- "service": "Azure Data Explorer",
+ "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "Traffic Manager",
"services": [
- "RBAC",
- "Storage",
+ "TrafficManager",
"WAF"
],
- "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.",
+ "severity": "High",
+ "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "18ca6017-0265-4f4b-a46a-393af7f31728",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution",
- "service": "Azure Data Explorer",
+ "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
"services": [
- "WAF"
+ "AVD",
+ "WAF",
+ "Entra"
],
- "text": "Ingest data into each cluster in parallel",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?",
+ "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "description": "This configuration is also called 'always-on'. For critical application deployments with no tolerance for outages, you should use multiple Azure Data Explorer clusters across Azure paired regions.",
- "guid": "58a9c279-9c42-4bb6-9d0c-65556246b338",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration",
- "service": "Azure Data Explorer",
+ "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
+ "service": "Entra",
"services": [
- "ACR",
+ "Entra",
"WAF"
],
- "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
+ "ammp": true,
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "description": "This configuration is identical to the active-active-active configuration, but only involves two Azure paired regions. Configure dual ingestion, processing, and curation. Users are routed to the nearest region. The cluster SKU must be the same across regions.",
- "guid": "563a4dc7-4a74-48b6-922a-d190916a6649",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration",
- "service": "Azure Data Explorer",
+ "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
+ "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "service": "Front Door",
"services": [
- "ACR",
- "WAF"
+ "WAF",
+ "FrontDoor",
+ "AzurePolicy"
],
- "text": "For critical applications, create Active-Active configuration in two paired regions",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Deploy your WAF policy for Front Door in 'Prevention' mode' so that Web Application Firewall takes appropriate action to allow or deny traffic.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
+ "ammp": true,
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "description": "The Active-Hot configuration is similar to the Active-Active configuration in dual ingest, processing, and curation. While the standby cluster is online for ingestion, process, and curation, it isn't available to query. The standby cluster doesn't need to be in the same SKU as the primary cluster. It can be of a smaller SKU and scale, which may result in it being less performant. In a disaster scenario, users are redirected to the standby cluster, which can optionally be scaled up to increase performance.",
- "guid": "8fadfe27-7de2-483b-8ac3-52baa9b75708",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-hot-standby-configuration",
- "service": "Azure Data Explorer",
+ "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
+ "service": "Front Door",
"services": [
- "WAF"
+ "TrafficManager",
+ "WAF",
+ "FrontDoor"
],
- "text": "For applications, which required only read during failure, create Active-Hot standby configuration",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Avoid combining Azure Traffic Manager and Azure Front Door.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
+ "ammp": true,
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "description": "This solution offers the least resiliency (highest RPO and RTO), is the lowest in cost and highest in effort. In this configuration, there's no data recovery cluster. Configure continuous export of curated data (unless raw and intermediate data is also required) to a storage account that is configured GRS (Geo Redundant Storage). A data recovery cluster is spun up if there is a disaster recovery scenario. At that time, DDLs, configuration, policies, and processes are applied. Data is ingested from storage with the ingestion property kustoCreationTime to over-ride the ingestion time that defaults to system time.",
- "guid": "49aa8092-dc8e-4b9d-8bb7-3b26a5a67eba",
- "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration",
- "service": "Azure Data Explorer",
+ "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
+ "service": "Front Door",
"services": [
- "Storage",
- "ASR",
- "AzurePolicy",
- "Cost",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
- "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "description": "All database objects, policies, and configurations should be persisted in source control so they can be released to the cluster from your release automation tool.",
- "guid": "5a907e1e-348e-4f25-9c27-d32e8bbac757",
- "link": "https://learn.microsoft.com/azure/data-explorer/devops",
- "service": "Azure Data Explorer",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant",
+ "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
+ "service": "Front Door",
"services": [
- "AzurePolicy",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
- "text": "Wrap DevOps and source control around all your code",
- "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "1559ab91-53e8-4908-ae28-b84c33b6b780",
- "link": "https://learn.microsoft.com/azure/data-explorer/devops",
- "service": "Azure Data Explorer",
+ "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
+ "service": "Front Door",
"services": [
- "WAF"
+ "WAF",
+ "FrontDoor"
],
- "text": "Design, develop, and implement validation routines to ensure all clusters are in-sync from a data perspective.",
- "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
+ "severity": "Medium",
+ "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Kusto/clusters",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "8b9fe5c4-1049-4d40-9a82-2c3474d00f18",
- "link": "https://learn.microsoft.com/azure/data-explorer/devops",
- "service": "Azure Data Explorer",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId",
+ "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
+ "service": "Front Door",
"services": [
- "WAF"
+ "WAF",
+ "FrontDoor"
],
- "text": "Be fully cognizant of what it takes to build a cluster from scratch. Leverage Infrastructure as a Code for your deployments",
- "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.cache/redis",
+ "ammp": true,
+ "arm-service": "Microsoft.Network/loadBalancers",
"checklist": "WAF checklist",
- "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
- "service": "Redis",
+ "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
+ "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
+ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
+ "service": "Load Balancer",
"services": [
- "ACR",
- "WAF"
+ "WAF",
+ "LoadBalancer"
],
"severity": "High",
- "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.",
+ "text": "Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.cache/redis",
+ "ammp": true,
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
- "service": "Redis",
+ "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId",
+ "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
+ "service": "Front Door",
"services": [
- "Storage",
- "WAF"
+ "Cost",
+ "WAF",
+ "FrontDoor",
+ "AKV"
],
- "severity": "Medium",
- "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.cache/redis",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
- "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
- "service": "Redis",
+ "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
+ "service": "Front Door",
"services": [
- "Storage",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "Medium",
- "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available",
- "waf": "Reliability"
+ "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.cache/redis",
+ "ammp": true,
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
- "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
- "service": "Redis",
+ "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
+ "service": "Front Door",
"services": [
- "ASR",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
- "severity": "Medium",
- "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
- "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
- "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
- "service": "Event Hubs",
+ "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
+ "service": "Front Door",
"services": [
- "EventHubs",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
- "severity": "Low",
- "text": "Use customer-managed key option in data at rest encryption when required",
- "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "severity": "Medium",
+ "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.",
"waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
+ "ammp": true,
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ",
- "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
- "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
- "service": "Event Hubs",
+ "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
+ "service": "Front Door",
"services": [
- "EventHubs",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
- "severity": "Medium",
- "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
- "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "severity": "High",
+ "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.",
"waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
+ "ammp": true,
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It�s recommended that you treat this rule like an administrative root account and don�t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
- "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
- "service": "Event Hubs",
+ "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
+ "service": "Front Door",
"services": [
- "Entra",
- "AzurePolicy",
- "RBAC",
- "TrafficManager",
- "EventHubs",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
- "severity": "Medium",
- "text": "Avoid using root account when it is not necessary",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
+ "severity": "High",
+ "text": "Tune the Azure Front Door WAF for your workload by configuring the WAF in Detection mode to reduce and fix false positive detections.",
"waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
+ "ammp": true,
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ",
- "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
- "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
- "service": "Event Hubs",
+ "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
+ "service": "Front Door",
"services": [
- "Entra",
- "AKV",
- "Storage",
- "VM",
- "EventHubs",
- "WAF"
+ "WAF",
+ "FrontDoor",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "severity": "High",
+ "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.",
"waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
+ "ammp": true,
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.",
- "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
- "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
- "service": "Event Hubs",
+ "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
+ "service": "Front Door",
"services": [
- "RBAC",
- "EventHubs",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "High",
- "text": "Use least privilege data plane RBAC",
- "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.",
"waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
+ "ammp": true,
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.",
- "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
- "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
- "service": "Event Hubs",
+ "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
+ "service": "Front Door",
"services": [
- "EventHubs",
- "Monitor",
- "VNet",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
- "severity": "Medium",
- "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs",
- "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "severity": "High",
+ "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.",
"waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
- "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
- "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
- "service": "Event Hubs",
+ "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
+ "service": "Front Door",
"services": [
- "PrivateLink",
- "EventHubs",
- "VNet",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "Medium",
- "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.",
- "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
"waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
- "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
- "service": "Event Hubs",
+ "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
+ "service": "Front Door",
"services": [
- "EventHubs",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "Medium",
- "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
"waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "31d41e36-11c8-417b-8afb-c410d4391898",
- "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx",
- "service": "Event Hubs",
+ "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
+ "service": "Front Door",
"services": [
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "Medium",
- "text": "Leverage FTA Resillency HandBook",
- "waf": "Reliability"
+ "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "description": " This will be turned on automatically for a new EH namespace created from the portal with Premium, Dedicated, or Standard SKUs in a zone-enabled region. Both the EH metadata and the event data itself are replicated across zones",
- "guid": "f15bce21-9e4a-40eb-9787-9424d226786d",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones",
- "service": "Event Hubs",
+ "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
+ "service": "Front Door",
"services": [
- "EventHubs",
- "ACR",
"WAF"
],
- "severity": "High",
- "text": "Leverage Availability Zones if regionally applicable",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "20b56c56-ad58-4519-8f82-735c586bb281",
- "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers",
- "service": "Event Hubs",
+ "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
+ "service": "Front Door",
"services": [
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "Medium",
- "text": "Use the Premium or Dedicated SKUs for predicable performance",
- "waf": "Reliability"
+ "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "description": "The built-in geo-disaster recovery feature, when enabled, ensures that the entire configuration of anamespace (Event Hubs, Consumer Groups and settings) is continuously replicated from a primary namespace to a secondary namespace, and it allows a once-only failover move from the primary to the secondary at any time. Active/Passive feature is designed to make it easier to recover from and abandon a failed Azure region without having to change application configurations",
- "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal",
- "service": "Event Hubs",
+ "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
+ "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
+ "service": "App Gateway",
"services": [
- "EventHubs",
- "ASR",
+ "AppGW",
"WAF"
],
"severity": "High",
- "text": "Plan for Geo Disaster Recovery using Active Passive configuration",
- "waf": "Reliability"
+ "text": "Enable the Azure Application Gateway WAF bot protection rule set. The bot rules detect good and bad bots.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "description": "Should be used for DR configurations where an outage or loss of event data in the downed region cannot be tolerated. For these cases, follow the replication guidance and do not use the built-in geo-disaster recovery capability (active/passive). With Active/Active, Maintain multiple Event Hubs in different regions and namespaces, and events will be replicated between the hubs",
- "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e",
- "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview",
- "service": "Event Hubs",
+ "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
+ "service": "App Gateway",
"services": [
- "EventHubs",
- "ASR",
- "WAF"
+ "AppGW",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "For Business Critical Applications, use Active Active configuration",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Enable request body inspection feature enabled in Azure Application Gateway WAF policy.",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.eventhub/namespaces",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c",
- "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design",
- "service": "Event Hubs",
+ "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
+ "service": "App Gateway",
"services": [
- "EventHubs",
+ "AppGW",
"WAF"
],
- "severity": "Medium",
- "text": "Design Resilient Event Hubs",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Tune the Azure Application Gateway WAF in detection mode for your workload. Reduce false positive detections.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "ammp": true,
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
- "service": "AVS",
+ "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
+ "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
+ "service": "App Gateway",
"services": [
- "Entra",
- "Subscriptions",
- "WAF"
+ "AppGW",
+ "WAF",
+ "AzurePolicy"
],
"severity": "High",
- "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure",
+ "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "75089c20-990d-4927-b105-885576f76fc2",
- "service": "AVS",
+ "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
+ "service": "App Gateway",
"services": [
- "AVS",
+ "AppGW",
"WAF"
],
"severity": "Medium",
- "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure",
+ "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
- "service": "AVS",
+ "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
+ "service": "App Gateway",
"services": [
+ "AppGW",
"WAF"
],
- "severity": "High",
- "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'",
+ "severity": "Medium",
+ "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
- "service": "AVS",
+ "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
+ "service": "App Gateway",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)",
+ "severity": "Low",
+ "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
- "service": "AVS",
+ "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
+ "service": "App Gateway",
"services": [
+ "AppGW",
"WAF"
],
"severity": "Medium",
- "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)",
+ "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
- "service": "AVS",
+ "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
+ "service": "App Gateway",
"services": [
- "Entra",
+ "AppGW",
"WAF"
],
- "severity": "High",
- "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)",
+ "severity": "Medium",
+ "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
- "service": "AVS",
+ "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "App Gateway",
"services": [
- "RBAC",
- "AVS",
+ "AppGW",
"WAF"
],
"severity": "Medium",
- "text": "Has an RBAC model been created for use within VMware vSphere",
- "waf": "Security"
+ "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
- "service": "AVS",
+ "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "Front Door",
"services": [
- "RBAC",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "Medium",
- "text": "RBAC permissions should be granted on ADDS groups and not on specific users",
- "waf": "Security"
+ "text": "Add diagnostic settings to save your Azure Front Door WAF logs.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
- "service": "AVS",
+ "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
+ "service": "App Gateway",
"services": [
- "RBAC",
- "AVS",
+ "Sentinel",
+ "AppGW",
"WAF"
],
- "severity": "High",
- "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5",
- "service": "AVS",
+ "guid": "845f5f91-9c21-4674-a725-5ce890850e20",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "Front Door",
"services": [
- "RBAC",
- "WAF"
+ "Sentinel",
+ "WAF",
+ "FrontDoor"
],
- "severity": "High",
- "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
- "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking",
- "service": "AVS",
+ "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
+ "service": "App Gateway",
"services": [
- "AVS",
+ "AppGW",
"WAF"
],
- "severity": "High",
- "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5",
- "service": "AVS",
+ "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
+ "service": "App Gateway",
"services": [
- "NetworkWatcher",
- "VPN",
- "Monitor",
- "ExpressRoute",
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'",
+ "severity": "Medium",
+ "text": "Use WAF Policies instead of the legacy WAF configuration.",
"waf": "Operations"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99",
- "service": "AVS",
+ "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
+ "service": "App Gateway",
"services": [
- "NetworkWatcher",
- "AVS",
- "VM",
- "Monitor",
+ "AppGW",
+ "VNet",
+ "WAF",
"ExpressRoute",
- "WAF"
+ "VPN"
],
"severity": "Medium",
- "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection",
- "waf": "Operations"
+ "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265",
- "service": "AVS",
+ "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions",
+ "service": "Front Door",
"services": [
- "NetworkWatcher",
- "AVS",
- "VM",
- "Monitor",
- "WAF"
+ "WAF",
+ "FrontDoor"
],
"severity": "Medium",
- "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity",
- "waf": "Operations"
+ "text": "Make sure your origins only take traffic from your Azure Front Door instance.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
- "service": "AVS",
+ "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
+ "service": "App Gateway",
"services": [
- "ARS",
"WAF"
],
"severity": "High",
- "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).",
- "waf": "Operations"
+ "text": "You should encrypt traffic to the backend servers.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
- "service": "AVS",
+ "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
+ "service": "App Gateway",
"services": [
- "Entra",
- "RBAC",
- "AVS",
"WAF"
],
"severity": "High",
- "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)",
+ "text": "You should use a Web Application Firewall.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
- "service": "AVS",
+ "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
+ "service": "App Gateway",
"services": [
- "Entra",
- "RBAC",
- "AVS",
"WAF"
],
- "severity": "High",
- "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles",
+ "severity": "Medium",
+ "text": "Redirect HTTP to HTTPS",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5",
- "service": "AVS",
+ "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
+ "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
+ "service": "App Gateway",
"services": [
- "Entra",
- "AVS",
"WAF"
],
"severity": "Medium",
- "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)",
- "waf": "Security"
+ "text": "Use gateway-managed cookies to direct traffic from a user session to the same server for processing",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
- "service": "AVS",
+ "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
+ "service": "App Gateway",
"services": [
"WAF"
],
"severity": "High",
- "text": "Limit use of CloudAdmin account to emergency access only",
+ "text": "Enable connection draining during planned service updates to prevent connection loss to existing members of the backend pool",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
- "service": "AVS",
+ "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
+ "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
+ "service": "App Gateway",
+ "services": [
+ "WAF"
+ ],
+ "severity": "Low",
+ "text": "Create custom error pages to display a personalized user experience",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
+ "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
+ "service": "App Gateway",
"services": [
- "RBAC",
"WAF"
],
"severity": "Medium",
- "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter",
+ "text": "Edit HTTP requests and response headers for easier routing and information exchange between the client and server",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
- "service": "AVS",
+ "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "App Gateway",
+ "services": [
+ "WAF",
+ "FrontDoor"
+ ],
+ "severity": "Medium",
+ "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "WAF checklist",
+ "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "App Gateway",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials",
- "waf": "Security"
+ "text": "Use transport layer load balancing",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
- "service": "AVS",
+ "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
+ "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
+ "service": "App Gateway",
"services": [
- "Entra",
- "AVS",
- "VM",
"WAF"
],
- "severity": "High",
- "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution",
+ "severity": "Medium",
+ "text": "Configure routing based on host or domain name for multiple web applications on a single gateway",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
- "service": "AVS",
+ "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
+ "service": "App Gateway",
"services": [
+ "Entra",
"WAF"
],
"severity": "Medium",
- "text": "Is East-West traffic filtering implemented within NSX-T",
+ "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
- "service": "AVS",
+ "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
+ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
+ "service": "App Gateway",
"services": [
- "AVS",
"AppGW",
- "Firewall",
"WAF"
],
- "severity": "High",
- "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions",
+ "severity": "Low",
+ "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
- "service": "AVS",
+ "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d",
+ "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare",
+ "service": "Logic Apps",
"services": [
- "AVS",
"WAF"
],
"severity": "High",
- "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads",
- "waf": "Security"
+ "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
- "service": "AVS",
+ "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a",
+ "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "Logic Apps",
"services": [
- "Monitor",
- "AVS",
"WAF"
],
- "severity": "Medium",
- "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity",
- "waf": "Security"
+ "severity": "High",
+ "text": "Protect logic apps from region failures with zone redundancy and availability zones",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "guid": "334fdf91-c234-4182-a652-75269440b4be",
- "service": "AVS",
+ "guid": "1cda768f-a206-445d-8234-56f6a6e7286e",
+ "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "Logic Apps",
"services": [
- "DDoS",
- "VPN",
- "ExpressRoute",
- "VNet",
"WAF"
],
- "severity": "Medium",
- "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure",
- "waf": "Security"
+ "severity": "High",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
- "service": "AVS",
+ "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34",
+ "link": "https://learn.microsoft.com/azure/app-service/environment/intro",
+ "service": "Logic Apps",
"services": [
- "AVS",
- "WAF"
+ "WAF",
+ "AppSvc"
],
- "severity": "Medium",
- "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager",
- "waf": "Security"
+ "severity": "High",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
- "service": "AVS",
+ "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501",
+ "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/",
+ "service": "Logic Apps",
"services": [
- "AVS",
- "Defender",
"WAF"
],
"severity": "Medium",
- "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution",
- "waf": "Security"
+ "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
- "service": "AVS",
+ "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
- "Arc",
"WAF"
],
- "severity": "Medium",
- "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)",
- "waf": "Security"
+ "severity": "High",
+ "text": "Follow Metaprompting guardrails for resonsible AI",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
- "service": "AVS",
+ "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
+ "link": "https://github.com/Azure-Samples/AI-Gateway",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
- "SQL",
- "WAF"
+ "Entra",
+ "WAF",
+ "APIM"
],
- "severity": "Low",
- "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)",
- "waf": "Security"
+ "severity": "High",
+ "text": "Consider Gateway patterns with APIM or solutions like AI central for better rate limiting, load balancing, authentication and logging",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
- "service": "AVS",
+ "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
+ "service": "Azure OpenAI",
"services": [
- "AKV",
+ "Monitor",
"WAF"
],
- "severity": "Low",
- "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible",
- "waf": "Security"
+ "severity": "High",
+ "text": "Enable monitoring for your AOAI instances",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "5ac94222-3e13-4810-9230-81a941741583",
- "service": "AVS",
+ "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
- "WAF"
+ "Monitor",
+ "WAF",
+ "Subscriptions",
+ "AKV"
],
- "severity": "Medium",
- "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)",
- "waf": "Security"
+ "severity": "High",
+ "text": "Create alerts to notify teams of events such as an entry in the activity log created by an action performed on the resource, such as regenerating its subscription keys or a metric threshold such as the number of errors exceeding 10 in an hour",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
- "service": "AVS",
+ "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
"services": [
+ "Monitor",
"WAF"
],
"severity": "High",
- "text": "Ensure that the appropriate vSAN Data redundancy method is used (RAID specification)",
- "waf": "Reliability"
+ "text": "Monitor token usage to prevent service disruptions due to capacity",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "d88408f3-7273-44c8-96ba-280214590146",
- "service": "AVS",
+ "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
+ "service": "Azure OpenAI",
"services": [
- "Storage",
- "AzurePolicy",
+ "Monitor",
"WAF"
],
- "severity": "High",
- "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "observe metrics like processed inference tokens, generated completion tokens monitor for rate limit",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
- "service": "AVS",
+ "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
+ "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
+ "service": "Azure OpenAI",
"services": [
- "ASR",
- "WAF"
+ "WAF",
+ "APIM"
],
- "severity": "High",
- "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "If the diagnostics are not sufficient for you, consider using a gateway such as Azure API Managements in front of Azure OpenAI to log both incoming prompts and outgoing responses, where permitted",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
- "service": "AVS",
+ "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
+ "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
+ "service": "Azure OpenAI",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use Infrastructure as code to deploy the Azure OpenAI Service, model deployments, and all related resources",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
- "service": "AVS",
+ "guid": "4350d092-d234-4292-a752-8537a551c5bf",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
"services": [
- "AzurePolicy",
+ "Entra",
"WAF"
],
- "severity": "Medium",
- "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use Microsoft Entra Authentication with Managed Identity instead of API Key",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
- "service": "AVS",
+ "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
- "Cost",
"WAF"
],
- "severity": "Medium",
- "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used",
- "waf": "Cost"
+ "severity": "High",
+ "text": "Evaluate the performance/accuracy of the system with a known golden dataset which has the inputs and the correct answers. Leverage capabilities in PromptFlow for Evaluation.",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
- "service": "AVS",
+ "guid": "68889535-e327-4897-b31b-67d67be5962a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
- "Cost",
"WAF"
],
- "severity": "Low",
- "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution",
- "waf": "Cost"
+ "severity": "High",
+ "text": "Evaluate usage of Provisioned throughput model ",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
- "service": "AVS",
+ "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
+ "service": "Azure OpenAI",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Consider the use of Azure Private-Link when using other Azure Native Services",
- "waf": "Security"
+ "severity": "High",
+ "text": "Review and implement Azure AI content safety",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "db611712-6904-40b4-aa3d-3e0803276d4b",
- "service": "AVS",
+ "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
+ "service": "Azure OpenAI",
"services": [
"WAF"
],
"severity": "High",
- "text": "Ensure all required resource reside within the same Azure availability zone(s)",
+ "text": "Define and evaluate the throughput of the system based on tokens & response per minute and align with requirements",
"waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
- "service": "AVS",
+ "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
- "VM",
- "Defender",
"WAF"
],
"severity": "Medium",
- "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads",
- "waf": "Security"
+ "text": "Improve latency of the system by limiting token sizes, streaming options",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
- "service": "AVS",
+ "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
- "VM",
- "Arc",
+ "ServiceBus",
+ "Storage",
"WAF"
],
"severity": "Medium",
- "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads",
- "waf": "Security"
+ "text": "Estimate elasticity demands to determine synchronous and batch request segregation based on priority. For high priority, use synchronous approach and for low priority, asynchronous batch processing with queue is preferred",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
- "service": "AVS",
+ "guid": "5bda4332-4f24-4811-9331-82ba51752694",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
"WAF"
],
"severity": "High",
- "text": "Enable Diagnostic and metric logging on Azure VMware Solution",
- "waf": "Operations"
+ "text": "Benchmark token consumption requirements based on estimated demands from consumers. Consider using the Azure OpenAI benchmarking tool to help you validate the throughput if you are using Provisioned Throughput Unit deployments",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
- "service": "AVS",
+ "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
"services": [
- "Monitor",
- "AVS",
- "VM",
"WAF"
],
"severity": "Medium",
- "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads",
- "waf": "Operations"
+ "text": "If you are using Provisioned Throughput Units (PTUs), consider deploying a token-per-minute (TPM) deployment for overflow requests. Use a gateway to route requests to the TPM deployment when the PTU limits are reached.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
- "service": "AVS",
+ "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
+ "service": "Azure OpenAI",
"services": [
- "Backup",
- "AVS",
- "VM",
- "AzurePolicy",
"WAF"
],
- "severity": "Medium",
- "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Choose the right model for the right task. Pick models with right tradeoff between speed, quality of response and output complexity",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
- "service": "AVS",
+ "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
+ "link": "https://github.com/Azure/azure-openai-benchmark/",
+ "service": "Azure OpenAI",
"services": [
- "Monitor",
- "AVS",
- "Defender",
"WAF"
],
"severity": "Medium",
- "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution",
- "waf": "Security"
+ "text": "Have a baseline for performance without fine-tuning for knowing whether or not fine-tuning has improved model performance",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
- "service": "AVS",
+ "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
"services": [
- "Defender",
+ "ACR",
"WAF"
],
- "severity": "Medium",
- "text": "Are the applicable compliance baselines added to Microsoft Defender for Cloud",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Deploy multiple OAI instances across regions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
- "service": "AVS",
+ "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
+ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
- "WAF"
+ "Entra",
+ "WAF",
+ "APIM"
],
"severity": "High",
- "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment",
- "waf": "Security"
+ "text": "Implement retry & healthchecks with Gateway pattern like APIM",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
- "service": "AVS",
+ "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
+ "service": "Azure OpenAI",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Are data processing implications (service provider / service consumer model) clear and documented",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Ensure having adequate quotas of TPM & RPM for the workload",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "547c1747-dc56-4068-a714-435cd19dd244",
- "service": "AVS",
+ "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
+ "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
+ "service": "Azure OpenAI",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Consider using CMK (Customer Managed Key) for vSAN only if needed for compliance reason(s).",
- "waf": "Security"
+ "text": "Review the considerations in HAI toolkit guidance and apply those interaction practices for the slution",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
- "service": "AVS",
+ "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
+ "service": "Azure OpenAI",
"services": [
- "Monitor",
- "AVS",
+ "ACR",
"WAF"
],
- "severity": "High",
- "text": "Create dashboards to enable core Azure VMware Solution monitoring insights",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Deploy separate fine tuned models across regions if finetuning is employed",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
- "service": "AVS",
+ "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
+ "link": "https://learn.microsoft.com/azure/backup/backup-overview",
+ "service": "Azure OpenAI",
"services": [
- "Monitor",
- "AVS",
- "WAF"
+ "ASR",
+ "WAF",
+ "Backup"
],
- "severity": "High",
- "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Regularly backup and replicate critical data to ensure data availability and recoverability in case of data loss or system failures. Leverage Azure's backup and disaster recovery services to protect your data.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
- "service": "AVS",
+ "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
+ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "service": "Azure OpenAI",
"services": [
- "Monitor",
- "AVS",
"WAF"
],
"severity": "High",
- "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware",
- "waf": "Operations"
+ "text": "Azure AI search service tiers should be choosen to have a SLA ",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
- "service": "AVS",
+ "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
+ "link": "https://learn.microsoft.com/purview/purview",
+ "service": "Azure OpenAI",
"services": [
- "Monitor",
"WAF"
],
- "severity": "High",
- "text": "Ensure alerts are configured for Azure Service Health alerts and notifications",
- "waf": "Operations"
+ "severity": "Low",
+ "text": "Classify data and sensitivity, labeling with Microsoft Purview before generating the embeddings and make sure to treat the embeddings generated with same sensitivity and classification",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
- "service": "AVS",
+ "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
- "Storage",
"WAF"
],
- "severity": "Medium",
- "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Encrypt data used for RAG with SSE/Disk encryption with optional BYOK",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
- "service": "AVS",
+ "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
+ "link": "https://learn.microsoft.com/azure/search/search-security-overview",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
+ "ACR",
"WAF"
],
- "severity": "Low",
- "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Ensure TLS is enforced for data in transit across data sources, AI search used for Retrieval-Augmented Generation (RAG) and LLM communication",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
- "service": "AVS",
+ "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
"services": [
- "Storage",
- "VM",
- "AzurePolicy",
+ "RBAC",
"WAF"
],
"severity": "High",
- "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning",
- "waf": "Operations"
+ "text": "Use RBAC to manage access to Azure OpenAI services. Assign appropriate permissions to users and restrict access based on their roles and responsibilities",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
- "service": "AVS",
+ "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
+ "service": "Azure OpenAI",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource",
- "waf": "Operations"
+ "text": "Implement data encryption, masking or redaction techniques to hide sensitive data or replace it with obfuscated values in non-production environments or when sharing data for testing or troubleshooting purposes",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
- "service": "AVS",
+ "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction",
+ "service": "Azure OpenAI",
"services": [
- "Storage",
- "Backup",
+ "Defender",
+ "Sentinel",
+ "Monitor",
"WAF"
],
- "severity": "Medium",
- "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Utilize Azure Defender to detect and respond to security threats and set up monitoring and alerting mechanisms to identify suspicious activities or breaches. Leverage Azure Sentinel for advanced threat detection and response",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
- "service": "AVS",
+ "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
+ "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
- "Arc",
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)",
- "waf": "Operations"
+ "text": "Establish data retention and disposal policies to adhere to compliance regulations. Implement secure deletion methods for data that is no longer required and maintain an audit trail of data retention and disposal activities",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
- "service": "AVS",
+ "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
+ "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
+ "service": "Azure OpenAI",
"services": [
- "Monitor",
- "AVS",
- "WAF"
- ],
- "severity": "Medium",
- "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor",
- "waf": "Operations"
+ "WAF"
+ ],
+ "severity": "High",
+ "text": "Implement Prompt shields and groundedness detection using Content Safety ",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
- "service": "AVS",
+ "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
+ "link": "https://learn.microsoft.com/azure/compliance/",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
"WAF"
],
- "severity": "Medium",
- "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Ensure compliance with relevant data protection regulations, such as GDPR or HIPAA, by implementing privacy controls and obtaining necessary consents or permissions for data processing activities.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
- "service": "AVS",
+ "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
+ "service": "Azure OpenAI",
"services": [
- "Monitor",
- "AVS",
- "AzurePolicy",
"WAF"
],
"severity": "Medium",
- "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions",
- "waf": "Operations"
+ "text": "Educate your employees about data security best practices, the importance of handling data securely, and potential risks associated with data breaches. Encourage them to follow data security protocols diligently.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
- "service": "AVS",
+ "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
- "Defender",
"WAF"
],
- "severity": "Medium",
- "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud",
+ "severity": "High",
+ "text": "Keep production data separate from development and testing data. Only use real sensitive data in production and utilize anonymized or synthetic data in development and test environments.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
- "service": "AVS",
+ "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
+ "service": "Azure OpenAI",
"services": [
- "Backup",
"WAF"
],
"severity": "Medium",
- "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource",
- "waf": "Reliability"
+ "text": "If you have varying levels of data sensitivity, consider creating separate indexes for each level. For instance, you could have one index for general data and another for sensitive data, each governed by different access protocols",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
- "service": "AVS",
+ "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
+ "service": "Azure OpenAI",
"services": [
- "WAF"
+ "RBAC",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Have all DR solutions been considered and a solution that is best for your business been decided upon? [SRM/JetStream/Zerto/Veeam/...]",
- "waf": "Reliability"
+ "text": "Take segregation a step further by placing sensitive datasets in different instances of the service. Each instance can be controlled with its own specific set of RBAC policies",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
- "service": "AVS",
+ "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
+ "service": "Azure OpenAI",
"services": [
- "ASR",
"WAF"
],
- "severity": "Medium",
- "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Recognize that embeddings and vectors generated from sensitive information are themselves sensitive. This data should be afforded the same protective measures as the source material",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
- "service": "AVS",
+ "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
+ "service": "Azure OpenAI",
"services": [
+ "RBAC",
"WAF"
],
"severity": "High",
- "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible",
- "waf": "Reliability"
+ "text": "Apply RBAC to th data stores having embeddings and vectors and scope access based on role's access requirements",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "8255461e-2aee-4345-9aec-8339248b262d",
- "service": "AVS",
+ "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
+ "service": "Azure OpenAI",
"services": [
- "ASR",
- "WAF"
+ "WAF",
+ "PrivateLink"
],
- "severity": "Medium",
- "text": "Use the geopolitical region pair as the secondary disaster recovery environment",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Configure private endpoint for AI services to restrict service access within your network",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
- "service": "AVS",
+ "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
+ "service": "Azure OpenAI",
"services": [
- "WAF"
+ "VNet",
+ "WAF",
+ "Firewall"
],
"severity": "High",
- "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions",
- "waf": "Reliability"
+ "text": "Enforce strict inbound and outbound traffic control with Azure Firewall and UDRs and limit the external integration points",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
- "service": "AVS",
+ "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
- "ExpressRoute",
- "NVA",
"WAF"
],
- "severity": "Medium",
- "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Implement network segmentation and access controls to restrict access to the LLM application only to authorized users and systems and prevent lateral movement",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
- "service": "AVS",
+ "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
+ "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
+ "service": "Azure OpenAI",
"services": [
- "Backup",
"WAF"
],
"severity": "Medium",
- "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]",
- "waf": "Reliability"
+ "text": "Use prompt compression tools like LLMLingua or gprtrim",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
- "service": "AVS",
+ "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
- "Backup",
- "WAF"
+ "Entra",
+ "WAF",
+ "AKV"
],
- "severity": "Medium",
- "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Ensure that APIs and endpoints used by the LLM application are properly secured with authentication and authorization mechanisms, such as Managed identities, API keys or OAuth, to prevent unauthorized access.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
- "service": "AVS",
+ "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
+ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
+ "service": "Azure OpenAI",
"services": [
- "Backup",
"WAF"
],
"severity": "Medium",
- "text": "Deploy your backup solution outside of vSan, on Azure native components",
- "waf": "Reliability"
+ "text": "Enforce strong end user authentication mechanisms, such as multi-factor authentication, to prevent unauthorized access to the LLM application and associated network resources",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
- "service": "AVS",
+ "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
+ "Monitor",
"WAF"
],
- "severity": "Low",
- "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Implement network monitoring tools to detect and analyze network traffic for any suspicious or malicious activities. Enable logging to capture network events and facilitate forensic analysis in case of security incidents",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
- "service": "AVS",
+ "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
+ "service": "Azure OpenAI",
"services": [
"WAF"
],
- "severity": "Low",
- "text": "For manual deployments, all configuration and deployments must be documented",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Conduct security audits and penetration testing to identify and address any network security weaknesses or vulnerabilities in the LLM application's network infrastructure",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
- "service": "AVS",
+ "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
"WAF"
],
"severity": "Low",
- "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud",
- "waf": "Operations"
+ "text": "Azure AI Services are properly tagged for better management",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
- "service": "AVS",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
+ "service": "Azure OpenAI",
"services": [
"WAF"
],
"severity": "Low",
- "text": "For automated deployments, deploy a minimal private cloud and scale as needed",
- "waf": "Operations"
+ "text": "Azure AI Service accounts follows organizational naming conventions",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
- "service": "AVS",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
+ "service": "Azure OpenAI",
"services": [
"WAF"
],
- "severity": "Low",
- "text": "For automated deployments, request or reserve quota prior to starting the deployment",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Diagnostic logs in Azure AI services resources should be enabled",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
- "service": "AVS",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/ai-services/authentication",
+ "service": "Azure OpenAI",
"services": [
- "AzurePolicy",
+ "Entra",
"WAF"
],
- "severity": "Low",
- "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Key access (local authentication) is recommended to be disabled for security. After disabling key based access, Microsoft Entra ID becomes the only access method, which allows maintaining minimum privilege principle and granular control. ",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
- "service": "AVS",
+ "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
"services": [
- "AKV",
- "WAF"
+ "Entra",
+ "WAF",
+ "AKV"
],
- "severity": "Low",
- "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Store and manage keys securely using Azure Key Vault. Avoid hard-coding or embedding sensitive keys within your LLM application's code and retrieve them securely from Azure Key Vault using managed identities",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "255461e2-aee3-4553-afc8-339248b262d6",
- "service": "AVS",
+ "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Azure OpenAI",
"services": [
- "AKV",
- "AVS",
- "ExpressRoute",
- "WAF"
+ "WAF",
+ "AKV"
],
- "severity": "Low",
- "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Regularly rotate and expire keys stored in Azure Key Vault to minimize the risk of unauthorized access.",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
- "service": "AVS",
+ "guid": "adfe27be-e297-401a-a352-baaab79b088d",
+ "link": "https://github.com/openai/tiktoken",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
"WAF"
],
- "severity": "Low",
- "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use tiktoken to understand token sizes for token optimizations in conversational mode",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
- "service": "AVS",
+ "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
+ "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
+ "service": "Azure OpenAI",
"services": [
"WAF"
],
- "severity": "Low",
- "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Follow secure coding practices to prevent common vulnerabilities such as injection attacks, cross-site scripting (XSS), or security misconfigurations",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
- "service": "AVS",
+ "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
+ "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
- "Subscriptions",
"WAF"
],
- "severity": "Medium",
- "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Setup a process to regularly update and patch the LLM libraries and other system components",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
- "service": "AVS",
+ "guid": "e29711b1-352b-4eee-879b-588defc4972c",
+ "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
+ "service": "Azure OpenAI",
"services": [
- "Storage",
- "AzurePolicy",
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Adhere to Azure OpenAI or other LLMs terms of use, policies and guidance and allowed use cases",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
- "service": "AVS",
+ "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
+ "service": "Azure OpenAI",
"services": [
+ "Cost",
"WAF"
],
"severity": "Medium",
- "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)",
- "waf": "Performance"
+ "text": "Understand difference in cost of base models and fine tuned models and token step sizes",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
- "service": "AVS",
+ "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
+ "service": "Azure OpenAI",
"services": [
+ "Cost",
"WAF"
],
- "severity": "Medium",
- "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Batch requests, where possible, to minimize the per-call overhead which can reduce overall costs. Ensure you optimize batch size",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
- "service": "AVS",
+ "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
+ "service": "Azure OpenAI",
"services": [
+ "Monitor",
+ "Cost",
"WAF"
],
"severity": "Medium",
- "text": "Define and enforce scale in/out maximum limits for your environment in the automations",
- "waf": "Performance"
+ "text": "Set up a cost tracking system that monitors model usage and use that information to help inform model choices and prompt sizes",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
- "service": "AVS",
+ "guid": "166cd072-af9b-4141-a898-a535e737897e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
+ "service": "Azure OpenAI",
"services": [
- "Monitor",
"WAF"
],
"severity": "Medium",
- "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses",
- "waf": "Operations"
+ "text": "Set a maximum limit on the number of tokens per model response. Optimize the size to ensure it is large enough for a valid response",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "AVS",
+ "guid": "71ca7da8-cfa9-462a-8594-946da97dc3a2",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability",
+ "service": "Azure OpenAI",
"services": [
- "VM",
"WAF"
],
- "severity": "High",
- "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Review the guidance provided on setting up AI search for Reliability",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "AVS",
+ "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
+ "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
+ "service": "Azure OpenAI",
"services": [
+ "Storage",
"WAF"
],
- "severity": "High",
- "text": "When using MON, you cannot enable MON on more than 100 Network extensions",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Plan and manage AI Search Vector storage",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf",
- "service": "AVS",
+ "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
+ "service": "Azure OpenAI",
"services": [
- "VPN",
"WAF"
],
"severity": "Medium",
- "text": "If using a VPN connection for migrations, adjust your MTU size accordingly.",
- "waf": "Performance"
+ "text": "Apply LLMOps practices to automate the lifecycle management of your GenAI applications",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "e614658d-d457-4e92-9139-b821102cad6e",
- "service": "AVS",
+ "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
+ "service": "Azure OpenAI",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "For low connectivity regions connecting into Azure (500Mbps or less), considering deploying the HCX WAN optimization appliance",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Evaluate usage of billing models - PAYG vs PTU",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521",
- "service": "AVS",
+ "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
+ "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
+ "service": "Azure OpenAI",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Ensure that migrations are started from the on-premises appliance and NOT from the Cloud appliance (do NOT perform a reverse migration)",
- "waf": "Reliability"
+ "text": "Evaluate the quality of prompts and applications when switching between model versions",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
- "service": "AVS",
+ "guid": "3418db61-2712-4650-9bb4-7a393a080327",
+ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
+ "service": "Azure OpenAI",
"services": [
- "AVS",
- "VM",
- "Storage",
+ "Monitor",
"WAF"
],
"severity": "Medium",
- "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.",
- "waf": "Reliability"
+ "text": "Evaluate, monitor and refine your GenAI apps for features like groundedness, relevance, accuracy, coherence, fluency, �",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
- "service": "AVS",
+ "guid": "294798b1-578b-4219-a46c-eb5443513592",
+ "service": "Azure OpenAI",
"services": [
- "Storage",
- "ExpressRoute",
"WAF"
],
"severity": "Medium",
- "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions",
- "waf": "Reliability"
+ "text": "Evaluate your Azure AI Search results based on different search parameters",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
- "service": "AVS",
+ "guid": "2744293b-b628-4537-a551-19b08e8f5854",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
+ "service": "Azure OpenAI",
"services": [
- "Storage",
- "ExpressRoute",
"WAF"
],
"severity": "Medium",
- "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions",
- "waf": "Reliability"
+ "text": "Look at fine tuning models as way of increasing accuracy only when you have tried other basic approaches like prompt engineering and RAG with your data",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "AVS",
+ "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
+ "service": "Azure OpenAI",
"services": [
- "ASR",
"WAF"
],
- "severity": "High",
- "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Use prompt engineering techniques to improve the accuracy of LLM responses",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
- "service": "AVS",
+ "guid": "e737897e-71ca-47da-acfa-962a1594946d",
+ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
+ "service": "Azure OpenAI",
"services": [
"WAF"
],
- "severity": "High",
- "text": "If using stretched cluster, ensure that the SLA provided will meet your requirements",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Red team your GenAI applications",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
- "service": "AVS",
+ "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
+ "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
+ "service": "Azure OpenAI",
"services": [
- "ExpressRoute",
"WAF"
],
- "severity": "High",
- "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Provide end users with scoring options for LLM responses and track these scores. ",
+ "waf": "Operational Excellence"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "AVS",
+ "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
+ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
+ "service": "Azure OpenAI",
"services": [
- "ExpressRoute",
"WAF"
],
"severity": "High",
- "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.",
- "waf": "Reliability"
+ "text": "Consider Quota management practices",
+ "waf": "Cost Optimization"
},
{
- "arm-service": "Microsoft.AVS/privateClouds",
+ "arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "WAF checklist",
- "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
- "service": "AVS",
+ "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
+ "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
+ "service": "Azure OpenAI",
"services": [
- "WAF"
+ "Entra",
+ "WAF",
+ "APIM",
+ "ACR",
+ "LoadBalancer"
],
- "severity": "High",
- "text": "Have site disaster tolerance settings been properly considered and changed for your business if needed.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Use Load balancer solutions like APIM based gateway for balancing load and capacity across services and regions",
+ "waf": "Operational Excellence"
},
{
"arm-service": "Microsoft.Devices/IotHubs",
@@ -29161,4881 +32581,4980 @@
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "a85b86ad-884f-48e3-9273-4b875ba18f10",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/system-message#define-additional-safety-and-behavioral-guardrails",
- "service": "Azure OpenAI",
- "services": [
- "WAF"
- ],
- "severity": "High",
- "text": "Follow Metaprompting guardrails for resonsible AI",
- "waf": "Operational Excellence"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.App/containerApps",
"checklist": "WAF checklist",
- "guid": "d4391898-cd28-48be-b6b1-7cb8245451e1",
- "link": "https://github.com/Azure-Samples/AI-Gateway",
- "service": "Azure OpenAI",
+ "guid": "af416482-663c-4ed6-b195-b44c7068e09c",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#availability-zone-support",
+ "service": "Container Apps",
"services": [
- "Entra",
- "APIM",
"WAF"
],
"severity": "High",
- "text": "Consider Gateway patterns with APIM or solutions like AI central for better rate limiting, load balancing, authentication and logging",
- "waf": "Operational Excellence"
+ "text": "Leverage Availability Zones if regionally applicable",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.App/containerApps",
"checklist": "WAF checklist",
- "guid": "aed3453a-ec72-4392-97a1-52d6cc5e4029",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850",
- "service": "Azure OpenAI",
+ "guid": "95bc80ec-6499-4d14-a7d2-7d296b1d8abc",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#set-up-zone-redundancy-in-your-container-apps-environment",
+ "service": "Container Apps",
"services": [
- "Monitor",
"WAF"
],
"severity": "High",
- "text": "Enable monitoring for your AOAI instances",
- "waf": "Operational Excellence"
+ "text": "Use more than one replica and enable Zone Redundancy.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.App/containerApps",
"checklist": "WAF checklist",
- "guid": "697cb391-ed16-4b2d-886f-0a0241addde6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts",
- "service": "Azure OpenAI",
+ "guid": "ccaa4fc2-fdbc-4432-8bb7-f7e6469e4dc3",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Container Apps",
"services": [
- "AKV",
- "Monitor",
- "Subscriptions",
"WAF"
],
"severity": "High",
- "text": "Create alerts to notify teams of events such as an entry in the activity log created by an action performed on the resource, such as regenerating its subscription keys or a metric threshold such as the number of errors exceeding 10 in an hour",
- "waf": "Operational Excellence"
+ "text": "For cross-region DR, deploy container apps in multiple regions and follow active/active or active/passive application guidance.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.App/containerApps",
"checklist": "WAF checklist",
- "guid": "8a477cde-b486-41bc-9bc1-0ae66e25d4d5",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
+ "guid": "2ffada86-c031-4933-bf7d-0c45bc4e5919",
+ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity",
+ "service": "Container Apps",
"services": [
- "Monitor",
- "WAF"
+ "TrafficManager",
+ "WAF",
+ "FrontDoor"
],
"severity": "High",
- "text": "Monitor token usage to prevent service disruptions due to capacity",
- "waf": "Operational Excellence"
+ "text": "Use Front Door or Traffic Manager to route traffic to the closest region",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.DBforPostgreSQL/servers",
"checklist": "WAF checklist",
- "guid": "a3aec2c4-e243-46b0-936c-b45e17960eee",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring",
- "service": "Azure OpenAI",
+ "guid": "65285269-441c-44bf-9d3e-0844276d4bdc",
+ "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview",
+ "service": "PostgreSQL",
"services": [
- "Monitor",
"WAF"
],
"severity": "Medium",
- "text": "observe metrics like processed inference tokens, generated completion tokens monitor for rate limit",
- "waf": "Operational Excellence"
+ "text": "Leverage Flexible Server",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.DBforPostgreSQL/servers",
"checklist": "WAF checklist",
- "guid": "fbdf4cc2-eec4-4d76-8c31-d25ffbb46a39",
- "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562",
- "service": "Azure OpenAI",
+ "guid": "016ccf31-ae5a-41eb-9888-9535e227896d",
+ "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview#architecture-and-high-availability",
+ "service": "PostgreSQL",
"services": [
- "APIM",
"WAF"
],
- "severity": "Low",
- "text": "If the diagnostics are not sufficient for you, consider using a gateway such as Azure API Managements in front of Azure OpenAI to log both incoming prompts and outgoing responses, where permitted",
- "waf": "Operational Excellence"
+ "severity": "High",
+ "text": "Leverage Availability Zones where regionally applicable",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "Microsoft.DBforPostgreSQL/servers",
"checklist": "WAF checklist",
- "guid": "3af30ed3-2947-498b-8178-a2c5a46ceb54",
- "link": "https://github.com/Azure-Samples/openai-enterprise-iac",
- "service": "Azure OpenAI",
+ "guid": "31b67c67-be59-4519-8083-845d587cb391",
+ "link": "https://learn.microsoft.com/azure/postgresql/single-server/concepts-business-continuity#cross-region-read-replicas",
+ "service": "PostgreSQL",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Use Infrastructure as code to deploy the Azure OpenAI Service, model deployments, and all related resources",
- "waf": "Operational Excellence"
+ "severity": "Medium",
+ "text": "Leverage cross-region read replicas for BCDR",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "4350d092-d234-4292-a752-8537a551c5bf",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
+ "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
+ "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
+ "service": "AKS",
"services": [
- "Entra",
+ "AKS",
"WAF"
],
- "severity": "High",
- "text": "Use Microsoft Entra Authentication with Managed Identity instead of API Key",
- "waf": "Security"
+ "severity": "Low",
+ "text": "If required for AKS Windows workloads HostProcess containers can be used",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "4e4f1854-287d-45cd-a126-cc031af5b1fc",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-bulk-test-evaluate-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
+ "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
+ "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Evaluate the performance/accuracy of the system with a known golden dataset which has the inputs and the correct answers. Leverage capabilities in PromptFlow for Evaluation.",
- "waf": "Operational Excellence"
+ "severity": "Low",
+ "text": "Use KEDA if running event-driven workloads",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "68889535-e327-4897-b31b-67d67be5962a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---performance-efficiency",
- "service": "Azure OpenAI",
+ "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
+ "link": "https://dapr.io/",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Evaluate usage of Provisioned throughput model ",
- "waf": "Performance"
+ "severity": "Low",
+ "text": "Use Dapr to ease microservice development",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "cd288bed-6b17-4cb8-8454-51e1aed3453a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/overview",
- "service": "Azure OpenAI",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
+ "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
+ "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
+ "service": "AKS",
"services": [
+ "AKS",
"WAF"
],
"severity": "High",
- "text": "Review and implement Azure AI content safety",
- "waf": "Operational Excellence"
+ "text": "Use the SLA-backed AKS offering",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "1193846d-697c-4b39-8ed1-6b2d186f0a02",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#system-level-throughput",
- "service": "Azure OpenAI",
+ "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"services": [
+ "Cost",
"WAF"
],
- "severity": "High",
- "text": "Define and evaluate the throughput of the system based on tokens & response per minute and align with requirements",
- "waf": "Performance"
+ "severity": "Low",
+ "text": "Use Disruption Budgets in your pod and deployment definitions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "41addde6-8a47-47cd-bb48-61bc3bc10ae6",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#improve-performance",
- "service": "Azure OpenAI",
+ "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
+ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
+ "service": "ACR",
"services": [
+ "ACR",
"WAF"
],
- "severity": "Medium",
- "text": "Improve latency of the system by limiting token sizes, streaming options",
- "waf": "Performance"
+ "severity": "High",
+ "text": "If using a private registry, configure region replication to store images in multiple regions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "6e25d4d5-a3ae-4c2c-9e24-36b0336cb45e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
+ "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
+ "service": "AKS",
"services": [
- "Storage",
- "ServiceBus",
+ "Cost",
"WAF"
],
- "severity": "Medium",
- "text": "Estimate elasticity demands to determine synchronous and batch request segregation based on priority. For high priority, use synchronous approach and for low priority, asynchronous batch processing with queue is preferred",
- "waf": "Performance"
+ "severity": "Low",
+ "text": "Use an external application such as kubecost to allocate costs to different users",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "5bda4332-4f24-4811-9331-82ba51752694",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
+ "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
+ "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Benchmark token consumption requirements based on estimated demands from consumers. Consider using the Azure OpenAI benchmarking tool to help you validate the throughput if you are using Provisioned Throughput Unit deployments",
- "waf": "Performance"
+ "severity": "Low",
+ "text": "Use scale down mode to delete/deallocate nodes",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "4008ae7d-7e47-4432-96d8-bdcf55bce619",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
+ "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
+ "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
+ "service": "AKS",
"services": [
+ "AKS",
"WAF"
],
"severity": "Medium",
- "text": "If you are using Provisioned Throughput Units (PTUs), consider deploying a token-per-minute (TPM) deployment for overflow requests. Use a gateway to route requests to the TPM deployment when the PTU limits are reached.",
- "waf": "Performance"
+ "text": "When required use multi-instance partitioning GPU on AKS Clusters",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "e8a13f98-8794-424d-9267-86d60b96c97b",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/models",
- "service": "Azure OpenAI",
+ "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
+ "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Choose the right model for the right task. Pick models with right tradeoff between speed, quality of response and output complexity",
- "waf": "Performance"
+ "severity": "Low",
+ "text": "If running a Dev/Test cluster use NodePool Start/Stop",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "e9951904-8384-45c9-a6cb-2912156a1147",
- "link": "https://github.com/Azure/azure-openai-benchmark/",
- "service": "Azure OpenAI",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
+ "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
+ "service": "AKS",
"services": [
- "WAF"
+ "AKS",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Have a baseline for performance without fine-tuning for knowing whether or not fine-tuning has improved model performance",
- "waf": "Performance"
+ "text": "Use Azure Policy for Kubernetes to ensure cluster compliance",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "5e39f541-accc-4d97-a376-bcdb3750ab2a",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
+ "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
"services": [
- "ACR",
"WAF"
],
- "severity": "Low",
- "text": "Deploy multiple OAI instances across regions",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Separate applications from the control plane with user/system node pools",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "b039da6d-55d7-4c89-8adb-107d5325af62",
- "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability",
- "service": "Azure OpenAI",
+ "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
+ "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
+ "service": "AKS",
"services": [
- "Entra",
- "APIM",
"WAF"
],
- "severity": "High",
- "text": "Implement retry & healthchecks with Gateway pattern like APIM",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Add taint to your system nodepool to make it dedicated",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "5ca44e46-85e2-4223-ace8-bb12308ca5f1",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#introduction-to-quota",
- "service": "Azure OpenAI",
+ "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
+ "link": "https://learn.microsoft.com/azure/container-registry/",
+ "service": "AKS",
"services": [
+ "ACR",
"WAF"
],
"severity": "Medium",
- "text": "Ensure having adequate quotas of TPM & RPM for the workload",
- "waf": "Reliability"
+ "text": "Use a private registry for your images, such as ACR",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerregistry/registries",
"checklist": "WAF checklist",
- "guid": "ec723923-7a15-42d6-ac5e-402925387e5c",
- "link": "https://www.microsoft.com/research/project/guidelines-for-human-ai-interaction/",
- "service": "Azure OpenAI",
+ "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
+ "link": "https://learn.microsoft.com/azure/security-center/container-security",
+ "service": "ACR",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Review the considerations in HAI toolkit guidance and apply those interaction practices for the slution",
- "waf": "Operational Excellence"
+ "text": "Scan your images for vulnerabilities",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "7f154e3a-a369-4282-ae7e-316183687a04",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery",
- "service": "Azure OpenAI",
+ "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
+ "service": "AKS",
"services": [
- "ACR",
"WAF"
],
- "severity": "Medium",
- "text": "Deploy separate fine tuned models across regions if finetuning is employed",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Define app separation requirements (namespace/nodepool/cluster)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "77a1f893-5bda-4433-84f2-4811633182ba",
- "link": "https://learn.microsoft.com/azure/backup/backup-overview",
- "service": "Azure OpenAI",
+ "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
+ "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
+ "service": "AKS",
"services": [
- "Backup",
- "ASR",
- "WAF"
+ "WAF",
+ "AKV"
],
"severity": "Medium",
- "text": "Regularly backup and replicate critical data to ensure data availability and recoverability in case of data loss or system failures. Leverage Azure's backup and disaster recovery services to protect your data.",
- "waf": "Reliability"
+ "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "95b96ad8-844c-4e3b-8b38-b876ba2cf204",
- "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
- "service": "Azure OpenAI",
+ "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
+ "link": "https://learn.microsoft.com/azure/aks/update-credentials",
+ "service": "AKS",
"services": [
"WAF"
],
"severity": "High",
- "text": "Azure AI search service tiers should be choosen to have a SLA ",
- "waf": "Reliability"
+ "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "99013a5d-3ce4-474d-acbd-8682a6abca2a",
- "link": "https://learn.microsoft.com/purview/purview",
- "service": "Azure OpenAI",
+ "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
+ "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "Low",
- "text": "Classify data and sensitivity, labeling with Microsoft Purview before generating the embeddings and make sure to treat the embeddings generated with same sensitivity and classification",
+ "severity": "Medium",
+ "text": "If required add Key Management Service etcd encryption",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "4fda1dbf-3dd9-45d4-ac7c-891dca1f6d56",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/use-your-data-securely",
- "service": "Azure OpenAI",
+ "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
+ "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
+ "service": "AKS",
"services": [
+ "AKS",
"WAF"
],
- "severity": "High",
- "text": "Encrypt data used for RAG with SSE/Disk encryption with optional BYOK",
+ "severity": "Low",
+ "text": "If required consider using Confidential Compute for AKS",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "59ae558b-937d-4498-9e11-12dbd7ba012f",
- "link": "https://learn.microsoft.com/azure/search/search-security-overview",
- "service": "Azure OpenAI",
+ "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
+ "service": "AKS",
"services": [
- "ACR",
+ "Defender",
"WAF"
],
- "severity": "High",
- "text": "Ensure TLS is enforced for data in transit across data sources, AI search used for Retrieval-Augmented Generation (RAG) and LLM communication",
+ "severity": "Medium",
+ "text": "Consider using Defender for Containers",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "7b94ef6e-047d-42ea-8992-b1cd6e2054b2",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
+ "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
+ "service": "AKS",
"services": [
- "RBAC",
+ "Entra",
"WAF"
],
"severity": "High",
- "text": "Use RBAC to manage access to Azure OpenAI services. Assign appropriate permissions to users and restrict access based on their roles and responsibilities",
+ "text": "Use managed identities instead of Service Principals",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "9769e4a6-91e8-4838-ac93-6667e13c0056",
- "link": "https://learn.microsoft.com/azure/security/fundamentals/data-encryption-best-practices",
- "service": "Azure OpenAI",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
+ "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad",
+ "service": "AKS",
"services": [
+ "Entra",
"WAF"
],
"severity": "Medium",
- "text": "Implement data encryption, masking or redaction techniques to hide sensitive data or replace it with obfuscated values in non-production environments or when sharing data for testing or troubleshooting purposes",
+ "text": "Integrate authentication with AAD (using the managed integration)",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "74b1e945-b459-4837-be7a-d6c6d3b375a5",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction",
- "service": "Azure OpenAI",
+ "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
+ "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
+ "service": "AKS",
"services": [
- "Sentinel",
- "Monitor",
- "Defender",
"WAF"
],
- "severity": "High",
- "text": "Utilize Azure Defender to detect and respond to security threats and set up monitoring and alerting mechanisms to identify suspicious activities or breaches. Leverage Azure Sentinel for advanced threat detection and response",
+ "severity": "Medium",
+ "text": "Limit access to admin kubeconfig (get-credentials --admin)",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "c7acbe48-abe5-44cd-99f2-e87768468c55",
- "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791",
- "service": "Azure OpenAI",
+ "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
+ "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
+ "service": "AKS",
"services": [
- "AzurePolicy",
+ "Entra",
+ "RBAC",
"WAF"
],
"severity": "Medium",
- "text": "Establish data retention and disposal policies to adhere to compliance regulations. Implement secure deletion methods for data that is no longer required and maintain an audit trail of data retention and disposal activities",
+ "text": "Integrate authorization with AAD RBAC",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
- "checklist": "WAF checklist",
- "guid": "a9c27d9c-42bb-46bd-8c69-99a246f3389a",
- "link": "https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection",
- "service": "Azure OpenAI",
- "services": [
- "WAF"
- ],
- "severity": "High",
- "text": "Implement Prompt shields and groundedness detection using Content Safety ",
- "waf": "Operational Excellence"
- },
- {
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "a775c6ee-95b9-46ad-a844-ce3b2b38b876",
- "link": "https://learn.microsoft.com/azure/compliance/",
- "service": "Azure OpenAI",
+ "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
+ "service": "AKS",
"services": [
+ "RBAC",
+ "AKS",
"WAF"
],
"severity": "High",
- "text": "Ensure compliance with relevant data protection regulations, such as GDPR or HIPAA, by implementing privacy controls and obtaining necessary consents or permissions for data processing activities.",
+ "text": "Use namespaces for restricting RBAC privilege in Kubernetes",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "ba2cf204-9901-43a5-b3ce-474dccbd8682",
- "service": "Azure OpenAI",
+ "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
+ "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
+ "service": "AKS",
"services": [
+ "Entra",
"WAF"
],
"severity": "Medium",
- "text": "Educate your employees about data security best practices, the importance of handling data securely, and potential risks associated with data breaches. Encourage them to follow data security protocols diligently.",
+ "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "eae01e6e-842e-452f-9721-d928c1b1cd52",
- "service": "Azure OpenAI",
+ "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
+ "service": "AKS",
"services": [
+ "AKS",
"WAF"
],
- "severity": "High",
- "text": "Keep production data separate from development and testing data. Only use real sensitive data in production and utilize anonymized or synthetic data in development and test environments.",
+ "severity": "Medium",
+ "text": "For AKS non-interactive logins use kubelogin (preview)",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "1e54a29a-9de3-499c-bd7b-28dc93555620",
- "service": "Azure OpenAI",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
+ "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
+ "service": "AKS",
"services": [
+ "AKS",
"WAF"
],
"severity": "Medium",
- "text": "If you have varying levels of data sensitivity, consider creating separate indexes for each level. For instance, you could have one index for general data and another for sensitive data, each governed by different access protocols",
+ "text": "Disable AKS local accounts",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512",
- "service": "Azure OpenAI",
+ "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
+ "service": "AKS",
"services": [
- "RBAC",
- "AzurePolicy",
"WAF"
],
- "severity": "Medium",
- "text": "Take segregation a step further by placing sensitive datasets in different instances of the service. Each instance can be controlled with its own specific set of RBAC policies",
+ "severity": "Low",
+ "text": "Configure if required Just-in-time cluster access",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "a36498f6-dbad-438e-ad53-cc7ce1d7aaab",
- "service": "Azure OpenAI",
+ "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
+ "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
+ "service": "AKS",
"services": [
+ "Entra",
+ "AKS",
"WAF"
],
- "severity": "High",
- "text": "Recognize that embeddings and vectors generated from sensitive information are themselves sensitive. This data should be afforded the same protective measures as the source material",
+ "severity": "Low",
+ "text": "Configure if required AAD conditional access for AKS",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "3571449a-b805-43d8-af89-dc7b33be2a1a",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control",
- "service": "Azure OpenAI",
+ "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
+ "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
+ "service": "AKS",
"services": [
- "RBAC",
+ "AKS",
"WAF"
],
- "severity": "High",
- "text": "Apply RBAC to th data stores having embeddings and vectors and scope access based on role's access requirements",
+ "severity": "Low",
+ "text": "If required for Windows AKS workloads configure gMSA ",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "27f7b9e9-1be1-4f38-aef3-9812bd463cbb",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325",
- "service": "Azure OpenAI",
+ "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
+ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
+ "service": "AKS",
"services": [
- "PrivateLink",
+ "Entra",
"WAF"
],
- "severity": "High",
- "text": "Configure private endpoint for AI services to restrict service access within your network",
+ "severity": "Medium",
+ "text": "For finer control consider using a managed Kubelet Identity",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "ac8ac199-ebb9-41a3-9d90-cae2cc881370",
- "service": "Azure OpenAI",
+ "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
+ "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
+ "service": "AKS",
"services": [
- "VNet",
- "Firewall",
+ "ACR",
+ "AppGW",
"WAF"
],
- "severity": "High",
- "text": "Enforce strict inbound and outbound traffic control with Azure Firewall and UDRs and limit the external integration points",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "If using AGIC, do not share an AppGW across clusters",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "6f7c0cba-fe51-4464-add4-57e927138b82",
- "service": "Azure OpenAI",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
+ "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
+ "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
+ "service": "AKS",
"services": [
+ "AKS",
"WAF"
],
"severity": "High",
- "text": "Implement network segmentation and access controls to restrict access to the LLM application only to authorized users and systems and prevent lateral movement",
- "waf": "Security"
+ "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "7f42c78e-78cb-46a2-8ad1-90916e6a8d8f",
- "link": "https://www.microsoft.com/research/blog/llmlingua-innovating-llm-efficiency-with-prompt-compression/",
- "service": "Azure OpenAI",
+ "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
+ "service": "AKS",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Use prompt compression tools like LLMLingua or gprtrim",
- "waf": "Cost Optimization"
+ "text": "For Windows workloads use Accelerated Networking",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "1102cac6-eae0-41e6-b842-e52f4721d928",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity",
- "service": "Azure OpenAI",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
+ "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
"services": [
- "Entra",
- "AKV",
- "WAF"
+ "WAF",
+ "LoadBalancer"
],
"severity": "High",
- "text": "Ensure that APIs and endpoints used by the LLM application are properly secured with authentication and authorization mechanisms, such as Managed identities, API keys or OAuth, to prevent unauthorized access.",
- "waf": "Security"
+ "text": "Use the standard ALB (as opposed to the basic one)",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "c1b1cd52-1e54-4a29-a9de-399cfd7b28dc",
- "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/security-best-practices-for-genai-applications-openai-in-azure/ba-p/4027885",
- "service": "Azure OpenAI",
+ "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
+ "service": "AKS",
"services": [
+ "VNet",
"WAF"
],
"severity": "Medium",
- "text": "Enforce strong end user authentication mechanisms, such as multi-factor authentication, to prevent unauthorized access to the LLM application and associated network resources",
+ "text": "If using Azure CNI, consider using different Subnets for NodePools",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "93555620-2bfe-4456-9b0d-834a348b263e",
- "service": "Azure OpenAI",
+ "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
+ "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
+ "service": "AKS",
"services": [
- "Monitor",
- "WAF"
+ "VNet",
+ "WAF",
+ "PrivateLink"
],
"severity": "Medium",
- "text": "Implement network monitoring tools to detect and analyze network traffic for any suspicious or malicious activities. Enable logging to capture network events and facilitate forensic analysis in case of security incidents",
+ "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "6dd60512-a364-498f-9dba-d38ead53cc7c",
- "service": "Azure OpenAI",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
+ "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Conduct security audits and penetration testing to identify and address any network security weaknesses or vulnerabilities in the LLM application's network infrastructure",
- "waf": "Security"
+ "severity": "High",
+ "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "e1d7aaab-3571-4449-ab80-53d89f89dc7b",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/tag-resources?tabs=json",
- "service": "Azure OpenAI",
+ "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"services": [
+ "VNet",
"WAF"
],
- "severity": "Low",
- "text": "Azure AI Services are properly tagged for better management",
- "waf": "Operational Excellence"
+ "severity": "High",
+ "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations",
- "service": "Azure OpenAI",
+ "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "Low",
- "text": "Azure AI Service accounts follows organizational naming conventions",
- "waf": "Operational Excellence"
+ "severity": "High",
+ "text": "If using Azure CNI, check the maximum pods/node (default 30)",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://learn.microsoft.com/azure/ai-services/diagnostic-logging",
- "service": "Azure OpenAI",
+ "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .",
+ "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
+ "link": "https://learn.microsoft.com/azure/aks/internal-lb",
+ "service": "AKS",
"services": [
+ "VNet",
+ "AKS",
"WAF"
],
- "severity": "High",
- "text": "Diagnostic logs in Azure AI services resources should be enabled",
- "waf": "Operational Excellence"
+ "severity": "Low",
+ "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/ai-services/authentication",
- "service": "Azure OpenAI",
+ "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"services": [
- "Entra",
"WAF"
],
"severity": "High",
- "text": "Key access (local authentication) is recommended to be disabled for security. After disabling key based access, Microsoft Entra ID becomes the only access method, which allows maintaining minimum privilege principle and granular control. ",
- "waf": "Security"
+ "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "6b57cfc6-5546-41e1-a3e3-453a3c863964",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
+ "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
+ "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
+ "service": "AKS",
"services": [
- "Entra",
- "AKV",
"WAF"
],
- "severity": "High",
- "text": "Store and manage keys securely using Azure Key Vault. Avoid hard-coding or embedding sensitive keys within your LLM application's code and retrieve them securely from Azure Key Vault using managed identities",
+ "severity": "Low",
+ "text": "If required add your own CNI plugin",
"waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "8b652d6c-15f5-4129-9539-8e6ded227dd1",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Azure OpenAI",
+ "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
+ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
+ "service": "AKS",
"services": [
- "AKV",
+ "AKS",
"WAF"
],
- "severity": "High",
- "text": "Regularly rotate and expire keys stored in Azure Key Vault to minimize the risk of unauthorized access.",
- "waf": "Security"
+ "severity": "Low",
+ "text": "If required configure Public IP per node in AKS",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "adfe27be-e297-401a-a352-baaab79b088d",
- "link": "https://github.com/openai/tiktoken",
- "service": "Azure OpenAI",
+ "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-network",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Use tiktoken to understand token sizes for token optimizations in conversational mode",
- "waf": "Cost Optimization"
+ "severity": "Medium",
+ "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "42b06c21-d799-49a6-96f4-389a7f42c78e",
- "link": "https://learn.microsoft.com/azure/security/develop/secure-dev-overview",
- "service": "Azure OpenAI",
+ "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
+ "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Follow secure coding practices to prevent common vulnerabilities such as injection attacks, cross-site scripting (XSS), or security misconfigurations",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "78c06a73-a22a-4495-9e6a-8dc4a20e27c3",
- "link": "https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-dependency-scanning?view=azure-devops",
- "service": "Azure OpenAI",
+ "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Setup a process to regularly update and patch the LLM libraries and other system components",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "e29711b1-352b-4eee-879b-588defc4972c",
- "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct",
- "service": "Azure OpenAI",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
+ "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
+ "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
+ "service": "AKS",
"services": [
- "AzurePolicy",
+ "NVA",
"WAF"
],
"severity": "High",
- "text": "Adhere to Azure OpenAI or other LLMs terms of use, policies and guidance and allowed use cases",
- "waf": "Operational Excellence"
+ "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "d3cd21bf-7703-46e5-b6b4-bed3d503547c",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models",
- "service": "Azure OpenAI",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
+ "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
+ "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
+ "service": "AKS",
"services": [
- "Cost",
"WAF"
],
"severity": "Medium",
- "text": "Understand difference in cost of base models and fine tuned models and token step sizes",
- "waf": "Cost Optimization"
+ "text": "If using a public API endpoint, restrict the IP addresses that can access it",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "1347dc56-028a-471f-be1c-e15dd3f0d5e7",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching",
- "service": "Azure OpenAI",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
+ "link": "https://learn.microsoft.com/azure/aks/private-clusters",
+ "service": "AKS",
"services": [
- "Cost",
"WAF"
],
"severity": "High",
- "text": "Batch requests, where possible, to minimize the per-call overhead which can reduce overall costs. Ensure you optimize batch size",
- "waf": "Cost Optimization"
+ "text": "Use private clusters if your requirements mandate it",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "72d41e36-11cc-457b-9a4b-1410d43958a8",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs",
- "service": "Azure OpenAI",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
+ "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
"services": [
- "Monitor",
- "Cost",
- "WAF"
+ "AKS",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Set up a cost tracking system that monitors model usage and use that information to help inform model choices and prompt sizes",
- "waf": "Cost Optimization"
+ "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "166cd072-af9b-4141-a898-a535e737897e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/quota?tabs=rest#understanding-rate-limits",
- "service": "Azure OpenAI",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
+ "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
+ "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
+ "service": "AKS",
"services": [
- "WAF"
+ "AKS",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Set a maximum limit on the number of tokens per model response. Optimize the size to ensure it is large enough for a valid response",
- "waf": "Cost Optimization"
+ "severity": "High",
+ "text": "Enable a Kubernetes Network Policy option (Calico/Azure)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "71ca7da8-cfa9-462a-8594-946da97dc3a2",
- "link": "https://learn.microsoft.com/azure/search/search-reliability",
- "service": "Azure OpenAI",
+ "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"services": [
- "WAF"
+ "AKS",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Review the guidance provided on setting up AI search for Reliability",
- "waf": "Operational Excellence"
+ "severity": "High",
+ "text": "Use Kubernetes network policies to increase intra-cluster security",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "3266b225-86f4-4a16-92bd-ddea8a487cde",
- "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota",
- "service": "Azure OpenAI",
+ "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
+ "service": "AKS",
"services": [
- "Storage",
"WAF"
],
- "severity": "Medium",
- "text": "Plan and manage AI Search Vector storage",
- "waf": "Operational Excellence"
+ "severity": "High",
+ "text": "Use a WAF for web workloads (UIs or APIs)",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "b4861bc3-bc14-4aeb-9e66-e8d9a3aec218",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/how-to-end-to-end-llmops-with-prompt-flow?view=azureml-api-2",
- "service": "Azure OpenAI",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
+ "service": "AKS",
"services": [
- "WAF"
+ "VNet",
+ "AKS",
+ "WAF",
+ "DDoS"
],
"severity": "Medium",
- "text": "Apply LLMOps practices to automate the lifecycle management of your GenAI applications",
- "waf": "Operational Excellence"
+ "text": "Use DDoS Standard in the AKS Virtual Network",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "aa80932c-8ec9-4d1b-a770-26e5e6beba9e",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/provisioned-throughput-onboarding#understanding-the-provisioned-throughput-purchase-model",
- "service": "Azure OpenAI",
+ "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
+ "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
+ "link": "https://learn.microsoft.com/azure/aks/http-proxy",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Evaluate usage of billing models - PAYG vs PTU",
- "waf": "Cost Optimization"
+ "severity": "Low",
+ "text": "If required add company HTTP Proxy",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "e6436b07-36db-455f-9796-03334bdf9cc2",
- "link": "https://techcommunity.microsoft.com/t5/ai-azure-ai-services-blog/how-to-control-azure-openai-models/ba-p/4146793",
- "service": "Azure OpenAI",
+ "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
+ "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
+ "service": "AKS",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Evaluate the quality of prompts and applications when switching between model versions",
- "waf": "Operational Excellence"
+ "text": "Consider using a service mesh for advanced microservice communication management",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "3418db61-2712-4650-9bb4-7a393a080327",
- "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2",
- "service": "Azure OpenAI",
+ "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
+ "service": "AKS",
"services": [
"Monitor",
"WAF"
],
- "severity": "Medium",
- "text": "Evaluate, monitor and refine your GenAI apps for features like groundedness, relevance, accuracy, coherence, fluency, �",
- "waf": "Operational Excellence"
+ "severity": "High",
+ "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "294798b1-578b-4219-a46c-eb5443513592",
- "service": "Azure OpenAI",
+ "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
+ "service": "AKS",
"services": [
+ "Entra",
"WAF"
],
- "severity": "Medium",
- "text": "Evaluate your Azure AI Search results based on different search parameters",
- "waf": "Operational Excellence"
+ "severity": "Low",
+ "text": "Check regularly Azure Advisor for recommendations on your cluster",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "2744293b-b628-4537-a551-19b08e8f5854",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/fine-tuning-considerations",
- "service": "Azure OpenAI",
+ "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
+ "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
+ "service": "AKS",
"services": [
+ "AKS",
"WAF"
],
- "severity": "Medium",
- "text": "Look at fine tuning models as way of increasing accuracy only when you have tried other basic approaches like prompt engineering and RAG with your data",
- "waf": "Operational Excellence"
+ "severity": "Low",
+ "text": "Enable AKS auto-certificate rotation",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "287d9cec-166c-4d07-8af9-b141a898a535",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions",
- "service": "Azure OpenAI",
+ "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
+ "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
+ "service": "AKS",
"services": [
+ "AKS",
"WAF"
],
- "severity": "Medium",
- "text": "Use prompt engineering techniques to improve the accuracy of LLM responses",
- "waf": "Operational Excellence"
+ "severity": "High",
+ "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "e737897e-71ca-47da-acfa-962a1594946d",
- "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/red-teaming",
- "service": "Azure OpenAI",
+ "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
+ "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Red team your GenAI applications",
- "waf": "Security"
+ "severity": "High",
+ "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "edb117e6-76aa-4f66-aca4-8e5a95f2223e",
- "link": "https://www.microsoft.com/haxtoolkit/guideline/encourage-granular-feedback/",
- "service": "Azure OpenAI",
+ "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
+ "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Provide end users with scoring options for LLM responses and track these scores. ",
- "waf": "Operational Excellence"
+ "severity": "High",
+ "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "d5f3547c-c346-4d81-9028-a71ffe1b9b5d",
- "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/optimizing-azure-openai-a-guide-to-limits-quotas-and-best/ba-p/4076268",
- "service": "Azure OpenAI",
+ "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Consider Quota management practices",
- "waf": "Cost Optimization"
+ "severity": "Low",
+ "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.CognitiveServices/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "9de0d5d7-31d4-41e3-911c-817bfafbc410",
- "link": "https://github.com/Azure/aoai-apim/blob/main/README.md",
- "service": "Azure OpenAI",
+ "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
+ "link": "https://learn.microsoft.com/azure/aks/command-invoke",
+ "service": "AKS",
"services": [
- "Entra",
- "APIM",
- "LoadBalancer",
- "ACR",
+ "AKS",
"WAF"
],
- "severity": "Medium",
- "text": "Use Load balancer solutions like APIM based gateway for balancing load and capacity across services and regions",
- "waf": "Operational Excellence"
+ "severity": "Low",
+ "text": "Consider using AKS command invoke on private clusters",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "1fc2fc14-eea6-4e69-b8d9-a3edc218e687",
- "link": "https://polite-sea-0995b240f.2.azurestaticapps.net/technical-delivery-playbook/azure-services/analytics/purview/",
- "service": "Purview",
+ "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
+ "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Leverage FTA Resillency Handbook",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "For planned events consider using Node Auto Drain",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "ab067acb-49e5-4b96-8332-4ecf8cc13318",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
+ "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
+ "link": "https://learn.microsoft.com/azure/aks/faq",
+ "service": "AKS",
"services": [
"WAF"
],
"severity": "High",
- "text": "Plan for Data Center level outage",
- "waf": "Reliability"
+ "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "description": "1. Create the new account 2. Migrate configuration items 3. Run scans 4. Migrate custom typedefs and custom assets 5. Migrate relationships 6. Migrate glossary terms 7. Assign classifications to assets 8. Assign contacts to assets",
- "guid": "da611702-69f4-4fb4-aa3d-3ef7f3176c4b",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
+ "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Practice Failover for BCDR",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Use custom Node RG (aka 'Infra RG') name",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "97b15b8a-219a-44ab-bb57-879024d22678",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
+ "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
+ "link": "https://kubernetes.io/docs/setup/release/notes/",
+ "service": "AKS",
"services": [
- "Backup",
+ "AKS",
"WAF"
],
- "severity": "High",
- "text": "Plan a backup strategy and take regular backups",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Do not use deprecated Kubernetes APIs in your YAML manifests",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "6d20b56c-56a9-4581-89bf-8d8e5c586b7d",
- "link": "https://learn.microsoft.com/purview/manage-kafka-dotnet",
- "service": "Purview",
+ "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
+ "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
+ "service": "AKS",
"services": [
- "EventHubs",
"WAF"
],
"severity": "Low",
- "text": "Use Microsoft Purview's Event Hubs to subscribe and create entities to another account",
- "waf": "Reliability"
+ "text": "Taint Windows nodes",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "8cdc15ac-c075-4ee9-a130-a8889579e76b",
- "link": "https://learn.microsoft.com/purview/deployment-best-practices",
- "service": "Purview",
+ "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
+ "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Follow Purview accounts architectures and deployment best practices",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Keep windows containers patch level in sync with host patch level",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "896e710a-7da7-4be9-a56d-14d3c49d997c",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-collections",
- "service": "Purview",
+ "description": "Via Diagnostic Settings at the cluster level",
+ "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
+ "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
+ "service": "AKS",
"services": [
+ "Monitor",
"WAF"
],
- "severity": "Medium",
- "text": "Follow Collection Architectures and best practices",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "b3d1325a-a225-4c6f-9e06-85edddea8a4b",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-asset-lifecycle",
- "service": "Purview",
+ "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
+ "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Follow Assest lifecycle best practices",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "If required use nodePool snapshots",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "7cdeb3c6-1fc2-4fc1-9eea-6e69d8d9a3ed",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-automation",
- "service": "Purview",
+ "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
+ "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Follow automation best practices",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Consider spot node pools for non time-sensitive workloads",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "c218e687-ab06-47ac-a49e-5b9603324ecf",
- "link": "https://learn.microsoft.com/purview/disaster-recovery",
- "service": "Purview",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
+ "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"services": [
- "Backup",
+ "AKS",
"WAF"
],
- "severity": "Medium",
- "text": "Follow Backup and Migration Best practices",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Consider AKS virtual node for quick bursting",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "8cc13318-da61-4170-869f-4fb4aa3d3ef7",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-glossary",
- "service": "Purview",
+ "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
"services": [
+ "Monitor",
"WAF"
],
- "severity": "Medium",
- "text": "Follow Purview Glossary Best Practices",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "f3176c4b-97b1-45b8-a219-a4abeb578790",
- "link": "https://learn.microsoft.com/purview/concept-workflow",
- "service": "Purview",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
+ "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "Low",
- "text": "Leverage Workflows ",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "24d22678-6d20-4b56-a56a-958119bf8d8e",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-security",
- "service": "Purview",
+ "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
+ "service": "AKS",
"services": [
+ "Monitor",
"WAF"
],
"severity": "Medium",
- "text": "Follow Purview Security Best Practices",
- "waf": "Reliability"
+ "text": "Monitor CPU and memory utilization of the nodes",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "5c586b7d-8cdc-415a-ac07-5ee9b130a888",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-lineage-azure-data-factory",
- "service": "Purview",
+ "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
+ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
+ "service": "AKS",
"services": [
+ "Monitor",
"WAF"
],
"severity": "Medium",
- "text": "Follow Purview Data Lineage Best Practices",
- "waf": "Reliability"
+ "text": "If using Azure CNI, monitor % of pod IPs consumed per node",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "9579e76b-896e-4710-a7da-7be9956d14d3",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-scanning",
- "service": "Purview",
+ "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady",
+ "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
+ "service": "AKS",
"services": [
- "WAF"
+ "Monitor",
+ "EventHubs",
+ "Storage",
+ "WAF",
+ "ServiceBus"
],
"severity": "Medium",
- "text": "Follow Best Practices for Scanning Registered Sources",
- "waf": "Reliability"
+ "text": "Monitor OS disk queue depth in nodes",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "c49d997c-b3d1-4325-aa22-5c6f4e0685ed",
- "link": "https://learn.microsoft.com/purview/concept-best-practices-classification",
- "service": "Purview",
+ "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
+ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
+ "service": "AKS",
"services": [
- "WAF"
+ "Monitor",
+ "NVA",
+ "WAF",
+ "LoadBalancer"
],
"severity": "Medium",
- "text": "Follow Classification Best Practices in Governance Portal",
- "waf": "Reliability"
+ "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "ddea8a4b-7cde-4b3c-91fc-2fc14eea6e69",
- "link": "https://learn.microsoft.com/purview/sensitivity-labels-frequently-asked-questions",
- "service": "Purview",
+ "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
+ "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
+ "service": "AKS",
"services": [
+ "AKS",
"WAF"
],
"severity": "Medium",
- "text": "Perform Sensitivity Labelling in the Purview Data Map",
- "waf": "Reliability"
+ "text": "Subscribe to resource health notifications for your AKS cluster",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "d8d9a3ed-c218-4e68-9ab0-67acb49e5b96",
- "link": "https://learn.microsoft.com/purview/concept-data-share",
- "service": "Purview",
+ "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"services": [
- "Storage",
"WAF"
],
- "severity": "Low",
- "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Configure requests and limits in your pod specs",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "03324ecf-8cc1-4331-ada6-1170269f4fb4",
- "link": "https://learn.microsoft.com/purview/concept-insights",
- "service": "Purview",
+ "guid": "769ef669-1a48-435a-a942-223ece80b123",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "Low",
- "text": "Leverage Data Estate Insights",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Enforce resource quotas for namespaces",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "aa3d3ef7-f317-46c4-a97b-15b8a219a4ab",
- "link": "https://learn.microsoft.com/purview/catalog-adoption-insights",
- "service": "Purview",
+ "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "AKS",
"services": [
- "WAF"
+ "WAF",
+ "Subscriptions"
],
- "severity": "Low",
- "text": "Use Data stewardship and Catalog adoption",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Ensure your subscription has enough quota to scale out your nodepools",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "eb578790-24d2-4267-a6d2-0b56c56a9581",
- "link": "https://learn.microsoft.com/purview/concept-insights",
- "service": "Purview",
+ "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65",
+ "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "Low",
- "text": "Use Inventory and Ownership",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Configure Liveness and Readiness probes for all deployments",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "19bf8d8e-5c58-46b7-b8cd-c15acc075ee9",
- "link": "https://learn.microsoft.com/purview/glossary-insights",
- "service": "Purview",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
+ "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"services": [
"WAF"
],
- "severity": "Low",
- "text": "Leverage Insights for Glossary, Classifications, Sensitivity Labels",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Use the Cluster Autoscaler",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "b130a888-9579-4e76-a896-e710a7da7be9",
- "link": "https://learn.microsoft.com/purview/compliance-manager",
- "service": "Purview",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
+ "guid": "831c2872-c693-4b39-a887-a561bada49bc",
+ "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
+ "service": "AKS",
"services": [
+ "AKS",
"WAF"
],
- "severity": "Medium",
- "text": "Generate assessment scores",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Customize node configuration for AKS node pools",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "956d14d3-c49d-4997-ab3d-1325aa225c6f",
- "link": "https://learn.microsoft.com/purview/compliance-manager-scoring",
- "service": "Purview",
+ "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
+ "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
+ "service": "AKS",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Profiling- get summaries of data content",
- "waf": "Reliability"
+ "text": "Use the Horizontal Pod Autoscaler when required",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "4e0685ed-ddea-48a4-a7cd-eb3c61fc2fc1",
- "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts",
- "service": "Purview",
+ "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity",
+ "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
+ "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
+ "service": "AKS",
"services": [
- "AzurePolicy",
"WAF"
],
- "severity": "Low",
- "text": "Follow Microsoft Purview Data Owner access policies",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Consider an appropriate node size, not too large or too small",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "4eea6e69-d8d9-4a3e-bc21-8e687ab067ac",
- "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy",
- "service": "Purview",
+ "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
+ "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
+ "service": "AKS",
"services": [
- "AzurePolicy",
+ "AKS",
"WAF"
],
"severity": "Low",
- "text": "Follow Self-service access policies",
- "waf": "Reliability"
+ "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Purview/accounts",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "b49e5b96-0332-44ec-b8cc-13318da61170",
- "link": "https://learn.microsoft.com/purview/concept-policies-devops",
- "service": "Purview",
+ "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
+ "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
+ "service": "AKS",
"services": [
- "AzurePolicy",
+ "AKS",
"WAF"
],
"severity": "Low",
- "text": "Follow DevOps policies",
- "waf": "Reliability"
+ "text": "Consider subscribing to EventGrid Events for AKS automation",
+ "waf": "Performance"
},
{
"arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
- "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
+ "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
+ "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
"service": "AKS",
"services": [
"AKS",
"WAF"
],
"severity": "Low",
- "text": "If required for AKS Windows workloads HostProcess containers can be used",
- "waf": "Reliability"
+ "text": "For long running operation on an AKS cluster consider event termination",
+ "waf": "Performance"
},
{
"arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
- "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
+ "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
+ "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
"service": "AKS",
"services": [
+ "AKS",
"WAF"
],
"severity": "Low",
- "text": "Use KEDA if running event-driven workloads",
+ "text": "If required consider using Azure Dedicated Hosts for AKS nodes",
"waf": "Performance"
},
{
"arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
- "link": "https://dapr.io/",
+ "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
+ "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
+ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
"service": "AKS",
"services": [
"WAF"
],
- "severity": "Low",
- "text": "Use Dapr to ease microservice development",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use ephemeral OS disks",
+ "waf": "Performance"
},
{
"arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
- "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
- "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
+ "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
"service": "AKS",
"services": [
"AKS",
"WAF"
],
"severity": "High",
- "text": "Use the SLA-backed AKS offering",
- "waf": "Reliability"
+ "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds",
+ "waf": "Performance"
},
{
"arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
+ "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
+ "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
"service": "AKS",
"services": [
- "Cost",
+ "Storage",
+ "AKS",
"WAF"
],
"severity": "Low",
- "text": "Use Disruption Budgets in your pod and deployment definitions",
- "waf": "Reliability"
+ "text": "For hyper performance storage option use Ultra Disks on AKS",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
- "service": "ACR",
+ "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
+ "service": "AKS",
"services": [
- "ACR",
+ "Storage",
+ "SQL",
"WAF"
],
- "severity": "High",
- "text": "If using a private registry, configure region replication to store images in multiple regions",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)",
+ "waf": "Performance"
},
{
"arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
+ "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
+ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
"service": "AKS",
"services": [
- "Cost",
+ "Storage",
"WAF"
],
- "severity": "Low",
- "text": "Use an external application such as kubecost to allocate costs to different users",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons",
+ "waf": "Performance"
},
{
"arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
- "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
+ "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
+ "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
"service": "AKS",
"services": [
+ "Storage",
"WAF"
],
- "severity": "Low",
- "text": "Use scale down mode to delete/deallocate nodes",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Insights/components",
"checklist": "WAF checklist",
- "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
- "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
- "service": "AKS",
+ "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
+ "service": "Azure Monitor",
"services": [
- "AKS",
+ "Monitor",
"WAF"
],
"severity": "Medium",
- "text": "When required use multi-instance partitioning GPU on AKS Clusters",
+ "text": "Data collection rules in Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
"waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
"checklist": "WAF checklist",
- "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
- "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
- "service": "AKS",
+ "guid": "45901365-d38e-443f-abcb-d868266abca2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Azure Backup",
"services": [
- "WAF"
+ "WAF",
+ "Backup"
],
- "severity": "Low",
- "text": "If running a Dev/Test cluster use NodePool Start/Stop",
+ "severity": "Medium",
+ "text": "check backup instances with the underlying datasource not found",
"waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
- "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
- "service": "AKS",
+ "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "VM",
"services": [
- "AKS",
- "AzurePolicy",
"WAF"
],
"severity": "Medium",
- "text": "Use Azure Policy for Kubernetes to ensure cluster compliance",
- "waf": "Security"
+ "text": "Delete or archive unassociated services (disks, nics, ip addresses etc)",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
- "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
+ "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Azure Backup",
"services": [
- "WAF"
+ "Storage",
+ "WAF",
+ "Backup",
+ "ASR"
],
"severity": "Medium",
- "text": "Separate applications from the control plane with user/system node pools",
- "waf": "Security"
+ "text": "Consider a good balance between site recovery storage and backup for non mission critical applications",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Insights/components",
"checklist": "WAF checklist",
- "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
- "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
- "service": "AKS",
+ "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
+ "service": "Azure Monitor",
"services": [
+ "Monitor",
"WAF"
],
- "severity": "Low",
- "text": "Add taint to your system nodepool to make it dedicated",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Check spending and savings opportunities among the 40 different log analytics workspaces- use different retention and data collection for nonprod workspaces-create daily cap for awareness and tier sizing - If you do set a daily cap, in addition to creating an alert when the cap is reached,ensure that you also create an alert rule to be notified when some percentage has been reached (90% for example). - consider workspace transformation if possible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Insights/components",
"checklist": "WAF checklist",
- "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
- "link": "https://learn.microsoft.com/azure/container-registry/",
- "service": "AKS",
+ "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Azure Monitor",
"services": [
- "ACR",
- "WAF"
+ "Storage",
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Use a private registry for your images, such as ACR",
- "waf": "Security"
+ "text": "Enforce a purging log policy and automation (if needed, logs can be moved to cold storage)",
+ "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
- "link": "https://learn.microsoft.com/azure/security-center/container-security",
- "service": "ACR",
+ "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "VM",
"services": [
- "WAF"
+ "Storage",
+ "WAF",
+ "Backup"
],
"severity": "Medium",
- "text": "Scan your images for vulnerabilities",
- "waf": "Security"
+ "text": "Check that the disks are really needed, if not: delete. If they are needed, find lower storage tiers or use backup -",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
- "service": "AKS",
+ "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
+ "service": "Storage",
"services": [
- "WAF"
+ "Storage",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Define app separation requirements (namespace/nodepool/cluster)",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Consider moving unused storage to lower tier, with customized rule - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
- "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
- "service": "AKS",
+ "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "VM",
"services": [
- "AKV",
+ "VM",
"WAF"
],
"severity": "Medium",
- "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver",
- "waf": "Security"
+ "text": "Make sure advisor is configured for VM right sizing ",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
- "link": "https://learn.microsoft.com/azure/aks/update-credentials",
- "service": "AKS",
+ "description": "check by searching the Meter Category Licenses in the Cost analysys",
+ "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
+ "service": "VM",
"services": [
- "WAF"
+ "VM",
+ "Cost",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "High",
- "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
- "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
- "service": "AKS",
+ "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "VM",
"services": [
- "WAF"
+ "WAF",
+ "LoadBalancer"
],
"severity": "Medium",
- "text": "If required add Key Management Service etcd encryption",
- "waf": "Security"
+ "text": " this can be also put under AHUB if you already have licenses https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
- "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
- "service": "AKS",
+ "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "VM",
"services": [
- "AKS",
+ "VM",
"WAF"
],
- "severity": "Low",
- "text": "If required consider using Confidential Compute for AKS",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)",
+ "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
- "service": "AKS",
+ "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
+ "service": "VM",
"services": [
- "Defender",
- "WAF"
+ "VM",
+ "Cost",
+ "WAF",
+ "ARS"
],
"severity": "Medium",
- "text": "Consider using Defender for Containers",
- "waf": "Security"
+ "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
- "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
- "service": "AKS",
+ "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
+ "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
+ "service": "VM",
"services": [
- "Entra",
"WAF"
],
- "severity": "High",
- "text": "Use managed identities instead of Service Principals",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Only larger disks can be reserved => 1 TiB -",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
- "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad",
- "service": "AKS",
+ "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
+ "service": "VM",
"services": [
- "Entra",
"WAF"
],
"severity": "Medium",
- "text": "Integrate authentication with AAD (using the managed integration)",
- "waf": "Security"
+ "text": "After the right-sizing optimization",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Sql/servers",
"checklist": "WAF checklist",
- "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
- "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
- "service": "AKS",
+ "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Azure SQL",
+ "services": [
+ "Cost",
+ "SQL",
+ "WAF",
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations",
+ "waf": "Cost"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "WAF checklist",
+ "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "VM",
"services": [
+ "VM",
"WAF"
],
"severity": "Medium",
- "text": "Limit access to admin kubeconfig (get-credentials --admin)",
- "waf": "Security"
+ "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
- "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
- "service": "AKS",
+ "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "VM",
"services": [
- "Entra",
- "RBAC",
+ "VM",
"WAF"
],
"severity": "Medium",
- "text": "Integrate authorization with AAD RBAC",
- "waf": "Security"
+ "text": "Consider using a VMSS to match demand rather than flat sizing",
+ "waf": "Cost"
},
{
"arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
+ "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
"service": "AKS",
"services": [
- "RBAC",
"AKS",
"WAF"
],
- "severity": "High",
- "text": "Use namespaces for restricting RBAC privilege in Kubernetes",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
"checklist": "WAF checklist",
- "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
- "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
- "service": "AKS",
+ "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Azure Backup",
"services": [
- "Entra",
"WAF"
],
"severity": "Medium",
- "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)",
- "waf": "Security"
+ "text": "Move recovery points to vault-archive where applicable (Validate)",
+ "training": "https://azure.microsoft.com/pricing/reservations/",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Databricks/workspaces",
"checklist": "WAF checklist",
- "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
- "service": "AKS",
+ "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
+ "service": "Databricks",
+ "services": [
+ "VM",
+ "WAF",
+ "LoadBalancer"
+ ],
+ "severity": "Medium",
+ "text": "Consider using Spot VMs with fallback where possible. Consider autotermination of clusters.",
+ "waf": "Cost"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
+ "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
+ "service": "Azure Functions",
"services": [
- "AKS",
"WAF"
],
"severity": "Medium",
- "text": "For AKS non-interactive logins use kubelogin (preview)",
- "waf": "Security"
+ "text": "Functions - Reuse connections",
+ "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
- "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
- "service": "AKS",
+ "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
+ "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
+ "service": "Azure Functions",
"services": [
- "AKS",
"WAF"
],
"severity": "Medium",
- "text": "Disable AKS local accounts",
- "waf": "Security"
+ "text": "Functions - Cache data locally",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
- "service": "AKS",
+ "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Azure Functions",
"services": [
+ "Storage",
"WAF"
],
- "severity": "Low",
- "text": "Configure if required Just-in-time cluster access",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
- "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
- "service": "AKS",
+ "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "Azure Functions",
+ "services": [
+ "WAF"
+ ],
+ "severity": "Medium",
+ "text": "Functions - Keep your functions warm",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Cost"
+ },
+ {
+ "arm-service": "Microsoft.Web/sites",
+ "checklist": "WAF checklist",
+ "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Azure Functions",
"services": [
- "Entra",
- "AKS",
"WAF"
],
- "severity": "Low",
- "text": "Configure if required AAD conditional access for AKS",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "When using autoscale with different functions, there might be one driving all the autoscale for all the resources - consider moving it to a separate consumption plan (and consider higher plan for CPU)",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
- "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
- "service": "AKS",
+ "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
+ "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
+ "service": "Azure Functions",
"services": [
- "AKS",
"WAF"
],
- "severity": "Low",
- "text": "If required for Windows AKS workloads configure gMSA ",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Function apps in a given plan are all scaled together, so any issues with scaling can affect all apps in the plan.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Web/sites",
"checklist": "WAF checklist",
- "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
- "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
- "service": "AKS",
+ "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
+ "service": "Azure Functions",
"services": [
- "Entra",
"WAF"
],
"severity": "Medium",
- "text": "For finer control consider using a managed Kubelet Identity",
- "waf": "Security"
+ "text": "Am I billed for 'await time'? This question is typically asked in the context of a C# function that does an async operation and waits for the result, e.g. await Task.Delay(1000) or await client.GetAsync('http://google.com'). The answer is yes - the GB second calculation is based on the start and end time of the function and the memory usage over that period. What actually happens over that time in terms of CPU activity is not factored into the calculation.One exception to this rule is if you are using durable functions. You are not billed for time spent at awaits in orchestrator functions.apply demand shaping techinques where possible (dev environments?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
- "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
- "service": "AKS",
+ "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Front Door",
"services": [
- "ACR",
- "AppGW",
- "WAF"
+ "EventHubs",
+ "WAF",
+ "FrontDoor"
],
"severity": "Medium",
- "text": "If using AGIC, do not share an AppGW across clusters",
- "waf": "Reliability"
+ "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
- "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
- "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
- "service": "AKS",
+ "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Front Door",
"services": [
- "AKS",
- "WAF"
+ "WAF",
+ "FrontDoor",
+ "AppSvc"
],
- "severity": "High",
- "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
- "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
- "service": "AKS",
+ "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
+ "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
+ "service": "Storage",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "For Windows workloads use Accelerated Networking",
- "waf": "Performance"
+ "text": "Consider archiving tiers for less used data",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
- "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
+ "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "VM",
"services": [
- "LoadBalancer",
"WAF"
],
- "severity": "High",
- "text": "Use the standard ALB (as opposed to the basic one)",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Check disk sizes where the size does not match the tier (i.e. A 513 GiB disk will pay a P30 (1TiB) and consider resizing",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
- "service": "AKS",
+ "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "Storage",
"services": [
- "VNet",
"WAF"
],
"severity": "Medium",
- "text": "If using Azure CNI, consider using different Subnets for NodePools",
- "waf": "Security"
+ "text": "Consider using standard SSD rather than Premium or Ultra where possible",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
- "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
- "service": "AKS",
+ "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "Storage",
"services": [
- "PrivateLink",
- "VNet",
+ "Storage",
"WAF"
],
"severity": "Medium",
- "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster",
- "waf": "Security"
+ "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
- "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "Site Recovery",
"services": [
+ "ASR",
"WAF"
],
- "severity": "High",
- "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
+ "service": "Storage",
"services": [
- "VNet",
+ "Storage",
"WAF"
],
- "severity": "High",
- "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Storage accounts: check hot tier and/or GRS necessary",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "VM",
"services": [
"WAF"
],
- "severity": "High",
- "text": "If using Azure CNI, check the maximum pods/node (default 30)",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Disks - validate use of Premium SSD disks everywhere: for example, non-prod could swap to Standard SSD or on-demand Premium SSD ",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Synapse/workspaces",
"checklist": "WAF checklist",
- "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .",
- "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
- "link": "https://learn.microsoft.com/azure/aks/internal-lb",
- "service": "AKS",
+ "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
+ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
+ "service": "Synapse",
"services": [
- "VNet",
- "AKS",
+ "Monitor",
+ "EventHubs",
+ "Cost",
"WAF"
],
- "severity": "Low",
- "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Synapse/workspaces",
"checklist": "WAF checklist",
- "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "Synapse",
"services": [
- "WAF"
+ "Storage",
+ "WAF",
+ "Cost"
],
- "severity": "High",
- "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Export cost data to a storage account for additional data analysis.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Synapse/workspaces",
"checklist": "WAF checklist",
- "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
- "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
- "service": "AKS",
+ "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "Synapse",
"services": [
+ "Cost",
+ "SQL",
"WAF"
],
- "severity": "Low",
- "text": "If required add your own CNI plugin",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Synapse/workspaces",
"checklist": "WAF checklist",
- "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
- "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
- "service": "AKS",
+ "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
+ "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
+ "service": "Synapse",
"services": [
- "AKS",
"WAF"
],
- "severity": "Low",
- "text": "If required configure Public IP per node in AKS",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Enable the serverless Apache Spark automatic pause feature and set your timeout value accordingly.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Synapse/workspaces",
"checklist": "WAF checklist",
- "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
- "link": "https://learn.microsoft.com/azure/aks/concepts-network",
- "service": "AKS",
+ "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
+ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
+ "service": "Synapse",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services",
- "waf": "Reliability"
+ "text": "Create multiple Apache Spark pool definitions of various sizes.",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Synapse/workspaces",
"checklist": "WAF checklist",
- "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
- "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
- "service": "AKS",
+ "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
+ "service": "Synapse",
"services": [
+ "Cost",
"WAF"
],
- "severity": "Low",
- "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
- "service": "AKS",
+ "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
+ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
+ "service": "VM",
"services": [
+ "VM",
+ "Cost",
"WAF"
],
"severity": "Medium",
- "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion",
- "waf": "Reliability"
+ "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
- "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
- "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
- "service": "AKS",
+ "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
+ "service": "VM",
"services": [
- "NVA",
+ "VM",
"WAF"
],
- "severity": "High",
- "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Right-sizing all VMs",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
- "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
- "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
- "service": "AKS",
+ "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
+ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
+ "service": "VM",
"services": [
+ "VM",
"WAF"
],
"severity": "Medium",
- "text": "If using a public API endpoint, restrict the IP addresses that can access it",
- "waf": "Security"
+ "text": "Swap VM sized with normalized and most recent sizes",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
- "link": "https://learn.microsoft.com/azure/aks/private-clusters",
- "service": "AKS",
+ "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
"services": [
+ "VM",
+ "Monitor",
"WAF"
],
- "severity": "High",
- "text": "Use private clusters if your requirements mandate it",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
- "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
+ "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "VM",
"services": [
- "AKS",
- "AzurePolicy",
+ "VM",
"WAF"
],
"severity": "Medium",
- "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ",
- "waf": "Security"
+ "text": "Containerizing an application can improve VM density and save money on scaling it",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Cost"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Search/searchServices",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
- "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
- "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
- "service": "AKS",
+ "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
"services": [
- "AKS",
- "AzurePolicy",
"WAF"
],
"severity": "High",
- "text": "Enable a Kubernetes Network Policy option (Calico/Azure)",
- "waf": "Security"
+ "text": "Enable 2 replicas to have 99.9% availability for read operations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Search/searchServices",
"checklist": "WAF checklist",
- "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "guid": "7d956fd9-788a-4845-9b9f-c0340972d810",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability",
+ "service": "Cognitive Search",
"services": [
- "AKS",
- "AzurePolicy",
"WAF"
],
- "severity": "High",
- "text": "Use Kubernetes network policies to increase intra-cluster security",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Enable 3 replicas to have 99.9% availability for read/write operations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Search/searchServices",
"checklist": "WAF checklist",
- "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
- "service": "AKS",
+ "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support",
+ "service": "Cognitive Search",
"services": [
"WAF"
],
"severity": "High",
- "text": "Use a WAF for web workloads (UIs or APIs)",
- "waf": "Security"
+ "text": "Leverage Availability Zones by enabling read and/or write replicas",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Search/searchServices",
"checklist": "WAF checklist",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
- "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
- "service": "AKS",
+ "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions",
+ "service": "Cognitive Search",
"services": [
- "AKS",
- "VNet",
- "DDoS",
+ "ACR",
"WAF"
],
"severity": "Medium",
- "text": "Use DDoS Standard in the AKS Virtual Network",
- "waf": "Security"
+ "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Search/searchServices",
"checklist": "WAF checklist",
- "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
- "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
- "link": "https://learn.microsoft.com/azure/aks/http-proxy",
- "service": "AKS",
+ "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services",
+ "service": "Cognitive Search",
"services": [
+ "ACR",
"WAF"
],
- "severity": "Low",
- "text": "If required add company HTTP Proxy",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Search/searchServices",
"checklist": "WAF checklist",
- "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
- "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
- "service": "AKS",
+ "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests",
+ "service": "Cognitive Search",
"services": [
+ "TrafficManager",
"WAF"
],
"severity": "Medium",
- "text": "Consider using a service mesh for advanced microservice communication management",
- "waf": "Security"
+ "text": "Use Azure Traffic Manager to coordinate requests",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Search/searchServices",
"checklist": "WAF checklist",
- "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
- "service": "AKS",
+ "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa",
+ "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives",
+ "service": "Cognitive Search",
"services": [
- "Monitor",
- "WAF"
+ "Storage",
+ "WAF",
+ "Backup"
],
"severity": "High",
- "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)",
- "waf": "Operations"
+ "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
- "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
- "service": "AKS",
+ "description": "Using the correct approach to feed a datalake with cold data and having the Kusto query engine at your disposal at the same time, as in the short-term storage",
+ "guid": "ba7da7be-9951-4914-a384-5d997cb39132",
+ "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export",
+ "service": "Azure Data Explorer",
"services": [
- "Entra",
- "WAF"
+ "Storage",
+ "WAF",
+ "Cost"
],
- "severity": "Low",
- "text": "Check regularly Azure Advisor for recommendations on your cluster",
- "waf": "Operations"
+ "text": "Leverage External Tables and Continuous data export overview to reduce costs",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
- "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
- "service": "AKS",
+ "description": "Azure Data Explorer provides an optional follower capability for a leader cluster to be followed by other follower clusters for read-only access to the leader's data and metadata. Changes in the leader, such as create, append, and drop are automatically synchronized to the follower. While the leaders could span Azure regions, the follower clusters should be hosted in the same region(s) as the leader. If the leader cluster is down or databases or tables are accidentally dropped, the follower clusters will lose access until access is recovered in the leader.",
+ "guid": "56a22586-f490-4641-addd-ea8a377cdeb3",
+ "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp",
+ "service": "Azure Data Explorer",
"services": [
- "AKS",
+ "Storage",
"WAF"
],
- "severity": "Low",
- "text": "Enable AKS auto-certificate rotation",
- "waf": "Operations"
+ "text": "To share data, explore Leader-follower cluster configuration",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
- "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
- "service": "AKS",
+ "description": "Azure Data Explorer doesn't support automatic protection against the outage of an entire Azure region. This disruption can happen during a natural disaster, like an earthquake. If you require a solution for a disaster recovery situation, do the following steps to ensure business continuity. In these steps, you'll replicate your clusters, management, and data ingestion in two Azure paired regions.",
+ "guid": "861bb2bc-14ae-4a6e-95d8-d9a3adc218e6",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters",
+ "service": "Azure Data Explorer",
"services": [
- "AKS",
+ "ASR",
"WAF"
],
- "severity": "High",
- "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature",
- "waf": "Operations"
+ "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
- "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
- "service": "AKS",
+ "guid": "436b0635-cb45-4e57-a603-324ace8cc123",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities",
+ "service": "Azure Data Explorer",
"services": [
+ "RBAC",
+ "Storage",
"WAF"
],
- "severity": "High",
- "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade",
- "waf": "Operations"
+ "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
- "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
- "service": "AKS",
+ "guid": "18ca6017-0265-4f4b-a46a-393af7f31728",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution",
+ "service": "Azure Data Explorer",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)",
- "waf": "Operations"
+ "text": "Ingest data into each cluster in parallel",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
- "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
- "service": "AKS",
+ "description": "This configuration is also called 'always-on'. For critical application deployments with no tolerance for outages, you should use multiple Azure Data Explorer clusters across Azure paired regions.",
+ "guid": "58a9c279-9c42-4bb6-9d0c-65556246b338",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration",
+ "service": "Azure Data Explorer",
"services": [
+ "ACR",
"WAF"
],
- "severity": "Low",
- "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters",
- "waf": "Operations"
+ "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
- "link": "https://learn.microsoft.com/azure/aks/command-invoke",
- "service": "AKS",
+ "description": "This configuration is identical to the active-active-active configuration, but only involves two Azure paired regions. Configure dual ingestion, processing, and curation. Users are routed to the nearest region. The cluster SKU must be the same across regions.",
+ "guid": "563a4dc7-4a74-48b6-922a-d190916a6649",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration",
+ "service": "Azure Data Explorer",
"services": [
- "AKS",
+ "ACR",
"WAF"
],
- "severity": "Low",
- "text": "Consider using AKS command invoke on private clusters",
- "waf": "Operations"
+ "text": "For critical applications, create Active-Active configuration in two paired regions",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
- "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
- "service": "AKS",
+ "description": "The Active-Hot configuration is similar to the Active-Active configuration in dual ingest, processing, and curation. While the standby cluster is online for ingestion, process, and curation, it isn't available to query. The standby cluster doesn't need to be in the same SKU as the primary cluster. It can be of a smaller SKU and scale, which may result in it being less performant. In a disaster scenario, users are redirected to the standby cluster, which can optionally be scaled up to increase performance.",
+ "guid": "8fadfe27-7de2-483b-8ac3-52baa9b75708",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-hot-standby-configuration",
+ "service": "Azure Data Explorer",
"services": [
"WAF"
],
- "severity": "Low",
- "text": "For planned events consider using Node Auto Drain",
- "waf": "Operations"
+ "text": "For applications, which required only read during failure, create Active-Hot standby configuration",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
- "link": "https://learn.microsoft.com/azure/aks/faq",
- "service": "AKS",
+ "description": "This solution offers the least resiliency (highest RPO and RTO), is the lowest in cost and highest in effort. In this configuration, there's no data recovery cluster. Configure continuous export of curated data (unless raw and intermediate data is also required) to a storage account that is configured GRS (Geo Redundant Storage). A data recovery cluster is spun up if there is a disaster recovery scenario. At that time, DDLs, configuration, policies, and processes are applied. Data is ingested from storage with the ingestion property kustoCreationTime to over-ride the ingestion time that defaults to system time.",
+ "guid": "49aa8092-dc8e-4b9d-8bb7-3b26a5a67eba",
+ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration",
+ "service": "Azure Data Explorer",
"services": [
- "WAF"
+ "Storage",
+ "AzurePolicy",
+ "WAF",
+ "ASR",
+ "Cost"
],
- "severity": "High",
- "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')",
- "waf": "Operations"
+ "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
- "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
+ "description": "All database objects, policies, and configurations should be persisted in source control so they can be released to the cluster from your release automation tool.",
+ "guid": "5a907e1e-348e-4f25-9c27-d32e8bbac757",
+ "link": "https://learn.microsoft.com/azure/data-explorer/devops",
+ "service": "Azure Data Explorer",
"services": [
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Low",
- "text": "Use custom Node RG (aka 'Infra RG') name",
- "waf": "Operations"
+ "text": "Wrap DevOps and source control around all your code",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
- "link": "https://kubernetes.io/docs/setup/release/notes/",
- "service": "AKS",
+ "guid": "1559ab91-53e8-4908-ae28-b84c33b6b780",
+ "link": "https://learn.microsoft.com/azure/data-explorer/devops",
+ "service": "Azure Data Explorer",
"services": [
- "AKS",
"WAF"
],
- "severity": "Medium",
- "text": "Do not use deprecated Kubernetes APIs in your YAML manifests",
- "waf": "Operations"
+ "text": "Design, develop, and implement validation routines to ensure all clusters are in-sync from a data perspective.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Kusto/clusters",
"checklist": "WAF checklist",
- "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
- "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
- "service": "AKS",
+ "guid": "8b9fe5c4-1049-4d40-9a82-2c3474d00f18",
+ "link": "https://learn.microsoft.com/azure/data-explorer/devops",
+ "service": "Azure Data Explorer",
"services": [
"WAF"
],
- "severity": "Low",
- "text": "Taint Windows nodes",
- "waf": "Operations"
+ "text": "Be fully cognizant of what it takes to build a cluster from scratch. Leverage Infrastructure as a Code for your deployments",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
- "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
- "service": "AKS",
+ "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c",
+ "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens",
+ "service": "Entra",
"services": [
+ "Entra",
"WAF"
],
- "severity": "Low",
- "text": "Keep windows containers patch level in sync with host patch level",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "description": "Via Diagnostic Settings at the cluster level",
- "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
- "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
- "service": "AKS",
+ "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops",
+ "service": "AAD B2C",
"services": [
- "Monitor",
"WAF"
],
- "severity": "Low",
- "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Make sure that your sign-in user flows are backed up and resilient. Make sure that the code that you use to sign-in your users are backed up and recoverable. Resilient interfaces with external processes",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
- "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
- "service": "AKS",
+ "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296",
+ "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network",
+ "service": "AAD B2C",
"services": [
"WAF"
],
- "severity": "Low",
- "text": "If required use nodePool snapshots",
- "waf": "Cost"
+ "severity": "Medium",
+ "text": "Custom brand assets should be hosted on a CDN",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
- "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
- "service": "AKS",
+ "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64",
+ "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance",
+ "service": "AAD B2C",
"services": [
"WAF"
],
"severity": "Low",
- "text": "Consider spot node pools for non time-sensitive workloads",
- "waf": "Operations"
+ "text": "Have multiple identiy providers (i.e., login with your microsoft, google, facebook accounts)",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
- "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"services": [
- "AKS",
+ "VM",
"WAF"
],
- "severity": "Low",
- "text": "Consider AKS virtual node for quick bursting",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
+ "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"services": [
- "Monitor",
"WAF"
],
- "severity": "High",
- "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Don't replicate! Replication can create issues with directory synchronization",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
- "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
- "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
- "service": "AKS",
+ "guid": "79b598de-fc59-472c-b4cd-21b078036f5e",
+ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/",
+ "service": "Windows AD",
"services": [
"WAF"
],
- "severity": "High",
- "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Have active-active for multi-regions",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
- "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
- "service": "AKS",
+ "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
"services": [
- "Monitor",
+ "Entra",
"WAF"
],
"severity": "Medium",
- "text": "Monitor CPU and memory utilization of the nodes",
- "waf": "Operations"
+ "text": "Add Azure AD Domain service stamps to additional regions and locations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
- "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
- "service": "AKS",
+ "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill",
+ "service": "Entra",
"services": [
- "Monitor",
"WAF"
],
"severity": "Medium",
- "text": "If using Azure CNI, monitor % of pod IPs consumed per node",
- "waf": "Operations"
+ "text": "Use Replica Sets for DR",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
"checklist": "WAF checklist",
- "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady",
- "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
- "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
- "service": "AKS",
+ "guid": "43e52f47-22d9-428c-8b1c-d521e54a29a9",
+ "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foundations-playbooks-CosmosDB_v1.docx",
+ "service": "CosmosDB",
"services": [
- "Storage",
- "Monitor",
- "EventHubs",
- "ServiceBus",
"WAF"
],
"severity": "Medium",
- "text": "Monitor OS disk queue depth in nodes",
- "waf": "Operations"
+ "text": "FTA Resiliency Playbook",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
"checklist": "WAF checklist",
- "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
- "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
- "service": "AKS",
+ "guid": "de39ac0e-7c28-4dc9-9565-7202bff4564b",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
+ "service": "CosmosDB",
"services": [
- "LoadBalancer",
- "Monitor",
- "NVA",
"WAF"
],
- "severity": "Medium",
- "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Leverage Availablity Zones where regionally applicable and ofcourse if the service offers it",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
"checklist": "WAF checklist",
- "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
- "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
- "service": "AKS",
+ "guid": "0d934a34-8b26-43e7-bd60-513a3649906e",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#replica-outages",
+ "service": "CosmosDB",
"services": [
- "AKS",
"WAF"
],
"severity": "Medium",
- "text": "Subscribe to resource health notifications for your AKS cluster",
- "waf": "Operations"
+ "text": "Run multiple replicas of the database (>1 ) in Prod",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
"checklist": "WAF checklist",
- "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
+ "description": "Multi-region writes capability allows you to take advantage of the provisioned throughput for your databases and containers across the globe",
+ "guid": "bad38ead-53cc-47de-8d8a-aab3571449ab",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions",
+ "service": "CosmosDB",
"services": [
+ "ACR",
"WAF"
],
- "severity": "High",
- "text": "Configure requests and limits in your pod specs",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Leverage Multi-Region Writes",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
"checklist": "WAF checklist",
- "guid": "769ef669-1a48-435a-a942-223ece80b123",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
- "service": "AKS",
+ "description": "Span Cosmos account across two or more regions with multi-region writes",
+ "guid": "8153d89f-89dc-47b3-9be2-b1a27f7b9e91",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas",
+ "service": "CosmosDB",
"services": [
+ "ACR",
"WAF"
],
"severity": "Medium",
- "text": "Enforce resource quotas for namespaces",
- "waf": "Operations"
+ "text": "Distribute your data globally",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
"checklist": "WAF checklist",
- "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
- "service": "AKS",
+ "description": "Choose from various consistency levels such as Eventual, Consistent Prefix, Session, Bounded Staleness and strong",
+ "guid": "9f8ea848-25ec-4140-bc32-2758e6ee9ac0",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/consistency-levels",
+ "service": "CosmosDB",
"services": [
- "Subscriptions",
"WAF"
],
"severity": "High",
- "text": "Ensure your subscription has enough quota to scale out your nodepools",
- "waf": "Operations"
+ "text": "Choose from several well-defined consistency models",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
"checklist": "WAF checklist",
- "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65",
- "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/",
- "service": "AKS",
+ "description": "Maintain business continuity during regional outages. Azure Cosmos DB supports service-managed failover during a regional outage. During a regional outage, Azure Cosmos DB continues to maintain its latency, availability, consistency, and throughput SLAs. To help make sure that your entire application is highly available, Azure Cosmos DB offers a manual failover API to simulate a regional outage. By using this API, you can carry out regular business continuity drills.",
+ "guid": "a47e4d1e-bb79-43f9-bf87-69e1032b72fe",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover",
+ "service": "CosmosDB",
"services": [
- "WAF"
+ "WAF",
+ "CosmosDB"
],
- "severity": "High",
- "text": "Configure Liveness and Readiness probes for all deployments",
- "waf": "Operations"
+ "severity": "Medium",
+ "text": "Enable Service managed failover",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
- "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "description": "Azure Cosmos DB automatically takes backups of your data at regular intervals. The automatic backups are taken without affecting the performance or availability of the database operations. All the backups are stored separately in a storage service.",
+ "guid": "3499c9c1-133d-42f7-a4b1-a5bd06ff1a90",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore",
+ "service": "CosmosDB",
"services": [
- "WAF"
+ "Storage",
+ "WAF",
+ "CosmosDB",
+ "Backup"
],
"severity": "Medium",
- "text": "Use the Cluster Autoscaler",
- "waf": "Performance"
+ "text": "Enable Automatic Backups",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
- "guid": "831c2872-c693-4b39-a887-a561bada49bc",
- "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
- "service": "AKS",
+ "description": "This mode is the default backup mode for all existing accounts. In this mode, backup is taken at a periodic interval and the data is restored by creating a request with the support team. In this mode, you configure a backup interval and retention for your account. The maximum retention period extends to a month. The minimum backup interval can be one hour.",
+ "guid": "a6eb33f6-005c-4d92-9286-7655672d6121",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction",
+ "service": "CosmosDB",
"services": [
- "AKS",
- "WAF"
+ "WAF",
+ "Backup"
],
- "severity": "Low",
- "text": "Customize node configuration for AKS node pools",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Perform Periodic Backups",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "microsoft.documentdb/databaseAccounts",
"checklist": "WAF checklist",
- "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
- "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
- "service": "AKS",
+ "description": "Continous 7 day retention and 30 day retention backups. Azure Cosmos DB performs data backup in the background without consuming any extra provisioned throughput (RUs) or affecting the performance and availability of your database. Continuous backups are taken in every region where the account exists.",
+ "guid": "d43918a8-cd28-49be-b6b1-7cb8245461e1",
+ "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction",
+ "service": "CosmosDB",
"services": [
- "WAF"
+ "WAF",
+ "CosmosDB",
+ "Backup"
],
"severity": "Medium",
- "text": "Use the Horizontal Pod Autoscaler when required",
- "waf": "Performance"
+ "text": "Continous Backup with point-in-time restore in Azure Cosmos DB",
+ "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity",
- "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
- "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
- "service": "AKS",
+ "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85",
+ "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview",
+ "service": "SAP",
"services": [
+ "SAP",
"WAF"
],
- "severity": "High",
- "text": "Consider an appropriate node size, not too large or too small",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
- "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
- "service": "AKS",
+ "guid": "5d75e99d-624d-4afe-91d9-e17adc580790",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops",
+ "service": "SAP",
"services": [
- "AKS",
+ "SAP",
"WAF"
],
- "severity": "Low",
- "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.",
+ "training": "https://github.com/Azure/sap-automation",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
- "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
- "service": "AKS",
+ "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform",
+ "service": "SAP",
"services": [
- "AKS",
+ "SAP",
"WAF"
],
- "severity": "Low",
- "text": "Consider subscribing to EventGrid Events for AKS automation",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
- "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
- "service": "AKS",
+ "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a",
+ "service": "SAP",
"services": [
- "AKS",
- "WAF"
+ "WAF",
+ "Backup"
],
- "severity": "Low",
- "text": "For long running operation on an AKS cluster consider event termination",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
- "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
- "service": "AKS",
+ "guid": "b651423c-8552-42db-a545-5cb50c05527a",
+ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
+ "service": "SAP",
"services": [
- "AKS",
- "WAF"
+ "Storage",
+ "WAF",
+ "ASR",
+ "Backup",
+ "SAP",
+ "SQL"
],
- "severity": "Low",
- "text": "If required consider using Azure Dedicated Hosts for AKS nodes",
- "waf": "Performance"
+ "severity": "High",
+ "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
- "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
- "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
- "service": "AKS",
+ "guid": "aa208dca-784f-46c6-9014-cc919c542dc9",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
"services": [
+ "SAP",
"WAF"
],
- "severity": "High",
- "text": "Use ephemeral OS disks",
- "waf": "Performance"
+ "severity": "Medium",
+ "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07",
- "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
- "service": "AKS",
+ "guid": "ba07c007-1f90-43e9-aa4f-601346b80352",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "SAP",
"services": [
- "AKS",
- "WAF"
+ "ASR",
+ "ExpressRoute",
+ "WAF",
+ "VPN"
],
"severity": "High",
- "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds",
- "waf": "Performance"
+ "text": "Set up ExpressRoute connections from on-premises to the primary and secondary Azure disaster recovery regions. Also, as an alternative to using ExpressRoute, consider setting up VPN connections from on-premises to the primary and secondary Azure disaster recovery regions.",
+ "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
- "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
- "service": "AKS",
+ "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "SAP",
"services": [
- "Storage",
- "AKS",
- "WAF"
+ "ACR",
+ "WAF",
+ "AKV"
],
"severity": "Low",
- "text": "For hyper performance storage option use Ultra Disks on AKS",
- "waf": "Performance"
+ "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
- "service": "AKS",
+ "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana",
+ "service": "SAP",
"services": [
- "Storage",
- "SQL",
- "WAF"
+ "VNet",
+ "SAP",
+ "WAF",
+ "ASR"
],
"severity": "Medium",
- "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)",
- "waf": "Performance"
+ "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
- "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
- "service": "AKS",
+ "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels",
+ "service": "SAP",
"services": [
"Storage",
- "WAF"
+ "WAF",
+ "SAP"
],
- "severity": "Medium",
- "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons",
- "waf": "Performance"
+ "severity": "Low",
+ "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.",
+ "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
"checklist": "WAF checklist",
- "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
- "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
- "service": "AKS",
+ "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
"services": [
- "Storage",
"WAF"
],
- "severity": "Medium",
- "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones",
- "waf": "Performance"
+ "severity": "High",
+ "text": "Native database replication technology should be used to synchronize the database in a HA pair.",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
- "service": "Key Vault",
+ "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad",
+ "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq",
+ "service": "SAP",
"services": [
- "AKV",
- "Backup",
+ "VNet",
"WAF"
],
"severity": "High",
- "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.",
+ "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
- "service": "Key Vault",
+ "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a",
+ "service": "SAP",
"services": [
- "AKV",
- "ACR",
- "WAF"
+ "VM",
+ "ASR",
+ "WAF",
+ "Entra"
],
- "severity": "Medium",
- "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.",
+ "severity": "High",
+ "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
- "service": "Key Vault",
+ "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"services": [
- "AKV",
+ "SAP",
"WAF"
],
- "severity": "Medium",
- "text": "The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. Familiarize yourself with the Key Vault's data replication.",
+ "severity": "High",
+ "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
- "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
- "service": "Key Vault",
+ "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations",
+ "service": "SAP",
"services": [
- "AKV",
- "AzurePolicy",
+ "SAP",
"WAF"
],
- "severity": "Medium",
- "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.",
+ "severity": "High",
+ "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
- "service": "Key Vault",
+ "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows",
+ "service": "SAP",
"services": [
- "AKV",
+ "VM",
"Storage",
- "Backup",
- "Subscriptions",
"WAF"
],
- "severity": "Medium",
- "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.",
+ "severity": "High",
+ "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.",
+ "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
+ "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general",
+ "service": "SAP",
"services": [
- "AKV",
- "WAF"
+ "Storage",
+ "WAF",
+ "SAP"
],
"severity": "High",
- "text": "If you want protection against accidental or malicious deletion of your secrets, configure soft-delete and purge protection features on your key vault.",
+ "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
- "service": "Key Vault",
+ "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk",
+ "service": "SAP",
"services": [
- "AKV",
+ "SAP",
"WAF"
],
- "severity": "Low",
- "text": "Key Vault's soft-deleted resources are retained for a set period of 90 calendar days. Familiarize yourself with the Key Vault's soft-delete guidance.",
+ "severity": "High",
+ "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
+ "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections",
+ "service": "SAP",
"services": [
- "AKV",
- "Backup",
- "WAF"
+ "SAP",
+ "WAF",
+ "LoadBalancer"
],
- "severity": "Low",
- "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.",
+ "severity": "High",
+ "text": "Most failover clusters for SAP application layer components (ASCS) and the DBMS layer require a virtual IP address for a failover cluster. Azure Load Balancer should handle the virtual IP address for all other cases. One design principle is to use one load balancer per cluster configuration. We recommend that you use the standard version of the load balancer (Standard Load Balancer SKU).",
+ "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
- "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
- "service": "Key Vault",
+ "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations",
+ "service": "SAP",
"services": [
- "AKV",
- "Backup",
- "WAF"
+ "WAF",
+ "LoadBalancer"
],
- "severity": "Low",
- "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.",
+ "severity": "High",
+ "text": "Make sure the Floating IP is enabled on the Load balancer",
+ "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
- "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
- "service": "Key Vault",
+ "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "SAP",
"services": [
- "AKV",
- "EventHubs",
"WAF"
],
- "severity": "Medium",
- "text": "Purge protection is recommended when using keys for encryption to prevent data loss. Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI, PowerShell or Portal.",
+ "severity": "High",
+ "text": "Before you deploy your high-availability infrastructure, and depending on the region you choose, determine whether to deploy with an Azure availability set or an availability zone.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage",
- "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
- "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
- "service": "Azure Storage",
+ "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea",
+ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1",
+ "service": "SAP",
"services": [
- "Storage",
- "WAF"
+ "VM",
+ "SAP",
+ "WAF",
+ "Entra"
],
- "severity": "Medium",
- "text": "Consider the 'Azure security baseline for storage'",
- "waf": "Security"
+ "severity": "High",
+ "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet",
- "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
- "service": "Azure Storage",
+ "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
"services": [
- "PrivateLink",
- "Storage",
- "WAF"
+ "VM",
+ "RBAC",
+ "WAF",
+ "Entra"
],
"severity": "High",
- "text": "Consider using private endpoints for Azure Storage",
- "waf": "Security"
+ "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription",
- "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
- "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
- "service": "Azure Storage",
+ "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/co-location",
+ "service": "SAP",
"services": [
- "RBAC",
- "Storage",
- "Subscriptions",
"WAF"
],
"severity": "Medium",
- "text": "Ensure older storage accounts are not using 'classic deployment model'",
- "waf": "Security"
+ "text": "You can't deploy Azure availability sets within an Azure availability zone unless you use proximity placement groups.",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.",
- "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
- "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
- "service": "Azure Storage",
+ "guid": "9674e7c7-7796-4181-8920-09f4429543ba",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "SAP",
"services": [
- "Storage",
- "Defender",
+ "VM",
"WAF"
],
"severity": "High",
- "text": "Enable Microsoft Defender for all of your storage accounts",
- "waf": "Security"
+ "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.",
- "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
- "service": "Azure Storage",
+ "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
"services": [
- "Storage",
+ "Entra",
+ "SAP",
"WAF"
],
- "severity": "Medium",
- "text": "Enable 'soft delete' for blobs",
- "waf": "Security"
+ "severity": "High",
+ "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
- "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
+ "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
"services": [
- "Storage",
+ "ACR",
+ "SAP",
"WAF"
],
- "severity": "Medium",
- "text": "Disable 'soft delete' for blobs",
- "waf": "Security"
+ "severity": "High",
+ "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.",
- "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
- "service": "Azure Storage",
+ "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"services": [
+ "Entra",
+ "SAP",
"WAF"
],
"severity": "High",
- "text": "Enable 'soft delete' for containers",
- "waf": "Security"
+ "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
- "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
+ "guid": "ed46b937-913e-4018-9c62-8393ab037e53",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid",
+ "service": "SAP",
"services": [
- "Storage",
- "WAF"
+ "VM",
+ "WAF",
+ "Entra"
],
"severity": "Medium",
- "text": "Disable 'soft delete' for containers",
- "waf": "Security"
+ "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion",
- "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
+ "guid": "f656e745-0cfb-453e-8008-0528fa21c933",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery",
+ "service": "SAP",
"services": [
+ "VM",
"Storage",
"WAF"
],
- "severity": "High",
- "text": "Enable resource locks on storage accounts",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.",
- "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
- "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
- "service": "Azure Storage",
+ "guid": "7f684ebc-95da-425e-b329-e782dbed050f",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance",
+ "service": "SAP",
"services": [
- "Storage",
- "Subscriptions",
- "AzurePolicy",
+ "SAP",
"WAF"
],
- "severity": "High",
- "text": "Consider immutable blobs",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ",
- "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
- "service": "Azure Storage",
+ "guid": "07991f7d-6598-4d90-9431-45c62605d3a5",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
"services": [
"Storage",
"WAF"
],
"severity": "High",
- "text": "Require HTTPS, i.e. disable port 80 on the storage account",
- "waf": "Security"
+ "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.",
- "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
- "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
- "service": "Azure Storage",
+ "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage",
+ "service": "SAP",
"services": [
"Storage",
- "WAF"
+ "WAF",
+ "SAP"
],
"severity": "High",
- "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.",
- "waf": "Security"
+ "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.",
+ "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.",
- "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
- "service": "Azure Storage",
+ "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage",
+ "service": "SAP",
"services": [
"Storage",
- "WAF"
+ "WAF",
+ "SAP",
+ "ASR"
],
- "severity": "Medium",
- "text": "Limit shared access signature (SAS) tokens to HTTPS connections only",
- "waf": "Security"
+ "severity": "High",
+ "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.",
+ "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "AAD tokens should be favored over shared access signatures, wherever possible",
- "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
- "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
- "service": "Azure Storage",
+ "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693",
+ "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
"services": [
- "Entra",
"Storage",
- "WAF"
+ "WAF",
+ "SAP"
],
"severity": "High",
- "text": "Use Azure Active Directory (Azure AD) tokens for blob access",
- "waf": "Security"
+ "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.",
- "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
- "service": "Azure Storage",
+ "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675",
+ "service": "SAP",
"services": [
- "RBAC",
- "WAF"
+ "SAP",
+ "WAF",
+ "Cost"
],
"severity": "Medium",
- "text": "Least privilege in IaM permissions",
- "waf": "Security"
+ "text": "Automate SAP System Start-Stop to manage costs.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ",
- "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
- "service": "Azure Storage",
+ "guid": "71dc00cd-4392-4262-8949-20c05e6c0333",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
"services": [
- "Entra",
"Storage",
- "WAF"
+ "Cost",
+ "WAF",
+ "VM",
+ "SAP"
],
- "severity": "High",
- "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.",
- "waf": "Security"
+ "severity": "Low",
+ "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on AAD authentication makes it easier to tie storage access to a user. ",
- "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
- "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
- "service": "Azure Storage",
+ "guid": "9877f353-2591-4e8b-8381-e9043fed1010",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1",
+ "service": "SAP",
"services": [
- "Entra",
- "AKV",
"Storage",
- "Monitor",
- "WAF"
+ "Cost",
+ "WAF",
+ "VM",
+ "SAP"
],
- "severity": "High",
- "text": "Consider disabling storage account keys, so that only AAD access (and user delegation SAS) is supported.",
- "waf": "Security"
+ "severity": "Low",
+ "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).",
- "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
- "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
- "service": "Azure Storage",
+ "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
+ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security",
+ "service": "SAP",
"services": [
- "AKV",
- "Storage",
- "AzurePolicy",
- "Monitor",
- "WAF"
+ "RBAC",
+ "WAF",
+ "Subscriptions"
],
"severity": "High",
- "text": "Consider using Azure Monitor to audit control plane operations on the storage account",
+ "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.",
- "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
- "service": "Azure Storage",
+ "guid": "45911475-e39e-4530-accc-d979366bcda2",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
"services": [
- "AKV",
- "Storage",
- "AzurePolicy",
+ "Entra",
+ "SAP",
"WAF"
],
"severity": "Medium",
- "text": "When using storage account keys, consider enabling a 'key expiration policy'",
+ "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.",
- "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
- "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
- "service": "Azure Storage",
+ "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration",
+ "service": "SAP",
"services": [
- "AzurePolicy",
+ "Entra",
+ "SAP",
"WAF"
],
"severity": "Medium",
- "text": "Consider configuring an SAS expiration policy",
+ "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ",
- "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
- "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
- "service": "Azure Storage",
+ "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
"services": [
- "AKV",
- "Storage",
- "AzurePolicy",
+ "SAP",
"WAF"
],
"severity": "Medium",
- "text": "Consider linking SAS to a stored access policy",
+ "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
- "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
- "service": "Azure Storage",
+ "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1",
+ "service": "SAP",
"services": [
- "AKV",
- "Storage",
+ "SAP",
"WAF"
],
"severity": "Medium",
- "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.",
+ "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.",
- "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
- "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
- "service": "Azure Storage",
+ "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial",
+ "service": "SAP",
"services": [
- "Entra",
- "Storage",
+ "SAP",
"WAF"
],
- "severity": "High",
- "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)",
+ "severity": "Medium",
+ "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.",
- "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
+ "service": "SAP",
"services": [
- "Storage",
- "AzurePolicy",
- "WAF"
+ "SAP",
+ "WAF",
+ "AKV"
],
- "severity": "High",
- "text": "Strive for short validity periods for ad-hoc SAS",
+ "severity": "Medium",
+ "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
+ "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.",
- "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
- "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
- "service": "Azure Storage",
+ "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
+ "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "WAF",
+ "AKV"
],
"severity": "Medium",
- "text": "Apply a narrow scope to a SAS",
+ "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ",
- "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
- "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
- "service": "Azure Storage",
+ "guid": "16785d6f-a96c-496a-b885-18f482734c88",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth",
+ "service": "SAP",
"services": [
+ "SAP",
"WAF"
],
"severity": "Medium",
- "text": "Consider scoping SAS to a specific client IP address, wherever possible",
+ "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.",
- "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
- "service": "Azure Storage",
+ "guid": "a747c350-8d4c-449c-93af-393dbca77c48",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial",
+ "service": "SAP",
"services": [
- "Storage",
+ "SAP",
"WAF"
],
- "severity": "Low",
- "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ",
+ "severity": "Medium",
+ "text": "Implement SSO to SAP HANA",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint",
- "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
- "service": "Azure Storage",
+ "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise",
+ "service": "SAP",
"services": [
"Entra",
- "RBAC",
- "Storage",
+ "SAP",
"WAF"
],
- "severity": "High",
- "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.",
+ "severity": "Medium",
+ "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
- "service": "Azure Storage",
+ "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753",
+ "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md",
+ "service": "SAP",
"services": [
+ "SAP",
"WAF"
],
"severity": "Medium",
- "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.",
+ "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.",
- "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
- "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
- "service": "Azure Storage",
+ "guid": "59921095-4980-4fc1-a5b6-524a5a560c79",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial",
+ "service": "SAP",
"services": [
- "Storage",
- "AzurePolicy",
+ "Entra",
+ "SAP",
"WAF"
],
- "severity": "High",
- "text": "Avoid overly broad CORS policies",
+ "severity": "Medium",
+ "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.",
- "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
- "service": "Azure Storage",
+ "guid": "a709c664-317e-41e4-9e34-67d9016a86f4",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial",
+ "service": "SAP",
"services": [
- "Storage",
+ "SAP",
"WAF"
],
- "severity": "High",
- "text": "Determine how data at rest should be encrypted. Understand the thread model for data.",
+ "severity": "Medium",
+ "text": "Implement SSO to SAP BTP",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
- "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
- "service": "Azure Storage",
+ "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8",
+ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial",
+ "service": "SAP",
"services": [
+ "Entra",
+ "SAP",
"WAF"
],
"severity": "Medium",
- "text": "Determine which/if platform encryption should be used.",
+ "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
- "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
- "service": "Azure Storage",
+ "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "WAF",
+ "Subscriptions",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Determine which/if client-side encryption should be used.",
- "waf": "Security"
+ "text": "enforce existing Management Group policies to SAP Subscriptions",
+ "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Leverage Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) to find storage accounts which allow anonymous blob access.",
- "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
- "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
- "service": "Azure Storage",
+ "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
"services": [
- "Storage",
- "WAF"
+ "SAP",
+ "WAF",
+ "Subscriptions"
],
"severity": "High",
- "text": "Consider whether public blob access is needed, or whether it can be disabled for certain storage accounts. ",
- "waf": "Security"
+ "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
- "service": "Azure Storage",
+ "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
"services": [
- "Storage",
- "WAF"
+ "WAF",
+ "Subscriptions"
],
"severity": "High",
- "text": "Leverage a storagev2 account type for better performance and reliability",
- "waf": "Reliability"
+ "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ",
+ "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Azure Storage",
+ "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
+ "link": "https://learn.microsoft.com/azure/quotas/quotas-overview",
+ "service": "SAP",
"services": [
- "Storage",
- "WAF"
+ "VM",
+ "WAF",
+ "Subscriptions"
],
"severity": "High",
- "text": "Leverage GRS, ZRS or GZRS storage for the highest availability",
- "waf": "Reliability"
+ "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)",
+ "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
- "service": "Azure Storage",
+ "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc",
+ "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity",
+ "service": "SAP",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "For write operation after failover, use customer-Managed Failover ",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "The Quota API is a REST API that you can use to view and manage quotas for Azure services. Consider using it if necessary.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
- "service": "Azure Storage",
+ "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8",
+ "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
+ "service": "SAP",
+ "services": [
+ "VM",
+ "WAF",
+ "Subscriptions"
+ ],
+ "severity": "High",
+ "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "WAF checklist",
+ "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
+ "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/",
+ "service": "SAP",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Understand Microsoft-Managed Failover details",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
- "service": "Azure Storage",
+ "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization",
+ "service": "SAP",
"services": [
+ "Cost",
+ "TrafficManager",
"WAF"
],
"severity": "Medium",
- "text": "Enable Soft Delete",
+ "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "WAF checklist",
+ "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
+ "services": [
+ "WAF",
+ "Backup"
+ ],
+ "severity": "High",
+ "text": "Help protect your HANA database by using the Azure Backup service.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachineScaleSets",
"checklist": "WAF checklist",
- "description": "Automatic instance repairs ensure that unhealthy instances are promptly identified and replaced, maintaining a set of healthy instances within your scale set.",
- "guid": "7e13c105-675c-41e9-95b4-59837ff7ae7c",
- "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs",
- "service": "VMSS",
+ "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction",
+ "service": "SAP",
"services": [
"VM",
- "WAF"
+ "Storage",
+ "WAF",
+ "Entra"
],
- "severity": "Low",
- "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency",
+ "severity": "Medium",
+ "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "Ensure that Azure Backup is utilized appropriately to meet your organization's resiliency requirements for Azure virtual machines (VMs).",
- "guid": "4d874a74-8b66-42d6-b150-512a66498f6d",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction",
- "service": "VM",
+ "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
"services": [
- "Backup",
- "VM",
+ "SAP",
"WAF"
],
"severity": "High",
- "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs",
- "waf": "Reliability"
+ "text": "Ensure time-zone matches between the operating system and the SAP system.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "Single Instance VMs using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks are guaranteed to have Virtual Machine Connectivity of at least 99.9%",
- "guid": "8052d88e-79d1-47b7-9b22-a5a67e7a8ed4",
- "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
- "service": "VM",
+ "guid": "c3c7abc0-716c-4486-893c-40e181d65539",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid",
+ "service": "SAP",
"services": [
- "VM",
+ "Entra",
"WAF"
],
- "severity": "High",
- "text": "Use Premium or Ultra disks for production VMs",
+ "severity": "Medium",
+ "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "Azure automatically replicates managed disks within a region to ensure data durability and protect against single-point failures.",
- "guid": "b31e38c3-f298-412b-8363-cffe179b599d",
- "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview",
- "service": "VM",
+ "guid": "a491dfc4-9353-4213-9217-eef0949f9467",
+ "link": "https://azure.microsoft.com/pricing/offers/dev-test/",
+ "service": "SAP",
"services": [
- "VM",
+ "Cost",
"WAF"
],
- "severity": "High",
- "text": "Ensure Managed Disks are used for all VMs",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.",
+ "waf": "Cost"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "Temporary disks are intended for short-term storage of non-persistent data such as page files, swap files, or SQL Server tempdb. Storing persistent data on temporary disks can lead to data loss during maintenance events or VM redeployment.",
- "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4",
- "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk",
- "service": "VM",
+ "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54",
+ "link": "https://learn.microsoft.com/azure/lighthouse/overview",
+ "service": "SAP",
"services": [
- "SQL",
- "Storage",
- "VM",
+ "Entra",
+ "SAP",
"WAF"
],
"severity": "Medium",
- "text": "Do not use the Temp disk for anything that is not acceptable to be lost",
- "waf": "Reliability"
+ "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "Co-locate your compute, storage, networking, and data resources across an availability zone, and replicate this arrangement in other availability zones.",
- "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e",
- "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
- "service": "VM",
+ "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
+ "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview",
+ "service": "SAP",
"services": [
- "ACR",
- "Storage",
"VM",
"WAF"
],
"severity": "Medium",
- "text": "Leverage Availability Zones for your VMs in regions where they are supported",
- "waf": "Reliability"
+ "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.",
+ "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "Use at least two VMs in Availability Sets to isolate VMs on different fault and update domains.",
- "guid": "5a785d6f-e96c-496a-b884-4cf3b2b38c88",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
- "service": "VM",
+ "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation",
+ "service": "SAP",
"services": [
- "VM",
+ "SAP",
"WAF"
],
- "severity": "Medium",
- "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "Azure provides multiple options for VM redundancy to meet different requirements (Availability Zones, Virtual Machine Scale Sets, Availability Sets, Azure Site Recovery)",
- "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "VM",
+ "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions",
+ "service": "SAP",
"services": [
- "VM",
- "ASR",
+ "Monitor",
+ "SAP",
+ "SQL",
"WAF"
],
- "severity": "High",
- "text": "Avoid running a production workload on a single VM",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "Azure Site Recovery enables you to achieve low RTO (Recovery Time Objective) for your Azure and hybrid VMs by providing continuous replication and failover capabilities.",
- "guid": "2a6bcca2-b5fe-4a1e-af3d-d95d48c7c891",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "VM",
+ "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap",
+ "service": "SAP",
"services": [
- "AVS",
+ "Monitor",
+ "Entra",
+ "WAF",
"VM",
- "ASR",
- "WAF"
+ "SAP"
],
"severity": "High",
- "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery",
- "waf": "Reliability"
+ "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "By using Capacity Reservations, you can effectively manage capacity for critical workloads, ensuring resource availability in specified regions.",
- "guid": "bd7bb012-f7b9-45e0-9e15-8e3ea3992c2d",
- "link": "https://learn.microsoft.com/azure/virtual-machines/capacity-reservation-overview",
- "service": "VM",
+ "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "SAP",
"services": [
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Low",
- "text": "Use Capacity Reservations for critical workloads that require guaranteed capacity",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "By ensuring that the necessary quotas are increased in your DR region before testing failover with ASR, you can avoid any potential resource constraints during the recovery process for failed over VMs.",
- "guid": "e6e2065b-3a76-4af4-a691-e8939ada4666",
- "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests",
- "service": "VM",
+ "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
+ "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview",
+ "service": "SAP",
"services": [
- "VM",
- "ASR",
- "WAF"
+ "Monitor",
+ "SAP",
+ "WAF",
+ "NetworkWatcher"
],
"severity": "Medium",
- "text": "Increase quotas in DR region before testing failover with ASR",
- "waf": "Reliability"
+ "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "Scheduled Events is an Azure Metadata Service that provides information about upcoming maintenance events for virtual machines (VMs). By leveraging Scheduled Events, you can proactively prepare your applications for VM maintenance, minimizing disruption and improving the availability of your VMs.",
- "guid": "6d3b475a-5c7a-4cbe-99bb-e64dd8902e87",
- "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events",
- "service": "VM",
+ "guid": "73686af4-6791-4f89-95ad-a43324e13811",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck",
+ "service": "SAP",
"services": [
"VM",
+ "SAP",
"WAF"
],
- "severity": "Low",
- "text": "Utilize Scheduled Events to prepare for VM maintenance",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Use Zone-redundant Storage (ZRS) in the primary region for scenarios that require high availability and for restricting replication to a particular country or region. For protection against regional disasters, use Geo-zone-redundant Storage (GZRS), which combines ZRS in the primary region with geo-replication to a secondary region?.",
- "guid": "48c7c891-dcb1-4f7d-9769-ae568ba38d4a",
- "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
- "service": "Azure Storage",
+ "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones",
+ "service": "SAP",
"services": [
- "Storage",
- "WAF"
+ "SAP",
+ "WAF",
+ "Subscriptions"
],
- "severity": "Medium",
- "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements",
- "waf": "Reliability"
+ "severity": "High",
+ "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.",
+ "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Assigning a Delete lock to your storage account helps protect the availability of your data, minimizing the risk of disruptions to your business operations.",
- "guid": "85e2213d-bd7b-4b01-8f7b-95e06e158e3e",
- "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
- "service": "Azure Storage",
+ "guid": "410adcba-db46-424f-a6c4-05ecde75c52e",
+ "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability",
+ "service": "SAP",
"services": [
"Storage",
- "WAF"
+ "WAF",
+ "ASR"
],
- "severity": "Low",
- "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts",
+ "severity": "Medium",
+ "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.",
+ "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Container soft delete protects your data from being accidentally deleted by maintaining the deleted data in the system for a specified period of time.",
- "guid": "a3992c2d-e6e2-4065-a3a7-6af4a691e893",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
- "service": "Azure Storage",
+ "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
+ "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview",
+ "service": "SAP",
"services": [
- "Storage",
+ "Monitor",
+ "Sentinel",
+ "SAP",
"WAF"
],
- "severity": "Low",
- "text": "Enable soft delete for Storage Account Containers",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.",
+ "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "description": "Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time.",
- "guid": "9ada4666-7e13-4c10-96b9-153d89f89dc7",
- "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
- "service": "Azure Storage",
+ "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
+ "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
+ "service": "SAP",
"services": [
- "Storage",
+ "Cost",
"WAF"
],
- "severity": "Low",
- "text": "Enable soft delete for blobs",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
"checklist": "WAF checklist",
- "description": "Azure Backup enhanced soft delete provides critical protection against ransomware attacks by retaining deleted backups, enabling recovery from potential ransomware encryption or deletion.",
- "guid": "b44be3b1-a27f-48b9-b91b-e1038df03a82",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about",
- "service": "Azure Backup",
+ "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows",
+ "service": "SAP",
"services": [
- "Backup",
+ "VM",
+ "Monitor",
"WAF"
],
- "severity": "Medium",
- "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery",
- "waf": "Reliability"
+ "severity": "Low",
+ "text": "Use inter-VM latency monitoring for latency-sensitive applications.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
"checklist": "WAF checklist",
- "description": "Azure Backup's multi-user authorization enables fine-grained control over user access to backup resources, allowing you to restrict privileges and ensure proper authentication and authorization for backup operations.",
- "guid": "2cd463cb-bbc8-4ac2-a9eb-c92a43da1dae",
- "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept",
- "service": "Azure Backup",
+ "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage",
+ "service": "SAP",
"services": [
- "Backup",
- "WAF"
+ "Monitor",
+ "SAP",
+ "WAF",
+ "ASR"
],
- "severity": "Low",
- "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources",
+ "severity": "Medium",
+ "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
"checklist": "WAF checklist",
- "description": "Azure Immutable Storage provides an additional layer of security by ensuring that backup data stored in the vault cannot be modified or deleted for a specified retention period. This helps safeguard your backups from ransomware attacks that may attempt to compromise or manipulate your backup data.",
- "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e",
- "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault",
- "service": "Azure Backup",
+ "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring",
+ "service": "SAP",
"services": [
"Storage",
- "Backup",
- "WAF"
+ "WAF",
+ "SAP"
],
- "severity": "Low",
- "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Network/dnsZones",
"checklist": "WAF checklist",
- "description": "To eliminate a single point of failure in your on-premises DNS services and ensure reliable DNS resolution during business continuity and disaster recovery scenarios, it is recommended to utilize Azure DNS Private Resolvers in multiple regions. By deploying two or more Azure DNS private resolvers across different regions, you can enable DNS failover and achieve resiliency in your DNS infrastructure.",
- "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146",
- "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover",
- "service": "DNS",
+ "guid": "c027f893-f404-41a9-b33d-39d625a14964",
+ "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login",
+ "service": "SAP",
"services": [
- "DNS",
- "ACR",
- "ASR",
+ "SAP",
"WAF"
],
"severity": "Low",
- "text": "Implement DNS Failover using Azure DNS Private Resolvers",
- "waf": "Reliability"
+ "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.PowerBI/gateways",
"checklist": "WAF checklist",
- "description": "Use an on-premises data gateway cluster to avoid single points of failure and to load balance traffic across gateways.",
- "guid": "89f89dc7-b44b-4e3b-8a27-f8b9e91be103",
- "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters",
- "service": "Data Gateways",
+ "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm",
+ "service": "SAP",
"services": [
- "ACR",
- "WAF"
+ "Storage",
+ "WAF",
+ "SAP"
],
"severity": "Medium",
- "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data",
- "waf": "Reliability"
+ "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.",
+ "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations",
+ "waf": "Performance"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "When choosing the best option for deploying NVAs in Azure, it is crucial to consider the vendor's recommendations and validate that the specific design has been vetted and validated by the NVA vendor. The vendor should also provide the necessary NVA configuration for seamless integration in Azure.",
- "guid": "8b1188b3-c6a4-46ce-a544-451e192d3442",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
- "service": "NVA",
+ "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178",
+ "service": "SAP",
"services": [
- "NVA",
+ "SAP",
+ "SQL",
"WAF"
],
- "severity": "High",
- "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.",
+ "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Front Door",
+ "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
"services": [
- "AKV",
- "FrontDoor",
- "WAF"
+ "Monitor",
+ "SAP",
+ "WAF",
+ "ASR"
],
- "severity": "Medium",
- "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal",
+ "severity": "High",
+ "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.",
+ "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
"waf": "Operations"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
- "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "App Gateway",
+ "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "SAP",
"services": [
"AppGW",
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Ensure you are using Application Gateway v2 SKU",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/",
"waf": "Security"
},
{
- "arm-service": "Microsoft.Network/loadBalancers",
"checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')",
- "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Load Balancer",
+ "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
"services": [
- "LoadBalancer",
+ "VM",
+ "DNS",
+ "SAP",
"WAF"
],
"severity": "Medium",
- "text": "Ensure you are using the Standard SKU for your Azure Load Balancers",
- "waf": "Security"
+ "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "waf": "Operations"
},
{
- "arm-service": "Microsoft.Network/loadBalancers",
"checklist": "WAF checklist",
- "guid": "9432621a-8397-4654-a882-5bc856b7ef83",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones",
- "service": "Load Balancer",
+ "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "service": "SAP",
"services": [
- "LoadBalancer",
+ "VNet",
+ "DNS",
+ "SAP",
"WAF"
],
"severity": "Medium",
- "text": "Ensure your Load Balancers frontend IP addresses are zone-redundant (unless you require zonal frontends).",
- "waf": "Security"
+ "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant",
- "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "App Gateway",
+ "guid": "a3592829-e6e2-4061-9368-6af46791f893",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
+ "service": "SAP",
"services": [
"VNet",
- "AppGW",
+ "ACR",
+ "SAP",
"WAF"
],
"severity": "Medium",
- "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Security"
+ "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions",
+ "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "description": "Administration of reverse proxies in general and WAF in particular is closer to the application than to networking, so they belong in the same subscription as the app. Centralizing the Application Gateway and WAF in the connectivity subscription might be OK if it is managed by one single team.",
- "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "App Gateway",
+ "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide",
+ "service": "SAP",
"services": [
- "Entra",
- "AppGW",
+ "SAP",
"NVA",
- "Subscriptions",
- "VNet",
"WAF"
],
- "severity": "Medium",
- "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Security"
+ "severity": "High",
+ "text": "It is not supported to deploy any NVA between SAP application and SAP Database server",
+ "training": "https://me.sap.com/notes/2731110",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "App Gateway",
+ "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3",
+ "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations",
+ "service": "SAP",
"services": [
- "DDoS",
- "WAF"
+ "ACR",
+ "SAP",
+ "WAF",
+ "VWAN"
],
"severity": "Medium",
- "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
+ "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant",
- "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant",
- "service": "App Gateway",
+ "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability",
+ "service": "SAP",
"services": [
+ "VNet",
+ "NVA",
"WAF"
],
"severity": "Medium",
- "text": "Configure autoscaling with a minimum amount of instances of two.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Reliability"
+ "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.",
+ "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant",
- "guid": "060c6964-52b5-48db-af8b-83e4b2d85349",
- "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2",
- "service": "App Gateway",
+ "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd",
+ "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture",
+ "service": "SAP",
"services": [
- "ACR",
- "AppGW",
- "WAF"
+ "NVA",
+ "VNet",
+ "WAF",
+ "SAP",
+ "VWAN"
],
"severity": "Medium",
- "text": "Deploy Application Gateway across Availability Zones",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Reliability"
+ "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "Front Door",
+ "guid": "82734c88-6ba2-4802-8459-11475e39e530",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
"services": [
- "FrontDoor",
- "AzurePolicy",
+ "VM",
+ "SAP",
"WAF"
],
- "severity": "Medium",
- "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "severity": "High",
+ "text": "Public IP assignment to VM running SAP Workload is not recommended.",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
- "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
- "service": "Front Door",
+ "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
+ "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations",
+ "service": "SAP",
"services": [
- "FrontDoor",
- "AppGW",
- "AzurePolicy",
+ "ASR",
"WAF"
],
- "severity": "Medium",
- "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Security"
+ "severity": "High",
+ "text": "Consider reserving IP address on DR side when configuring ASR",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Operations"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/trafficManagerProfiles",
"checklist": "WAF checklist",
- "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "Traffic Manager",
+ "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "SAP",
"services": [
- "TrafficManager",
"WAF"
],
"severity": "High",
- "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Reliability"
+ "text": "Avoid using overlapping IP address ranges for production and DR sites.",
+ "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations",
+ "waf": "Operations"
},
{
"checklist": "WAF checklist",
- "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "Entra",
+ "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
+ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet",
+ "service": "SAP",
"services": [
- "Entra",
- "AVD",
+ "VNet",
+ "Storage",
"WAF"
],
- "severity": "Low",
- "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?",
- "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.",
+ "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations",
+ "waf": "Operations"
},
{
"checklist": "WAF checklist",
- "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
- "service": "Entra",
+ "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
+ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json",
+ "service": "SAP",
+ "services": [
+ "WAF",
+ "Firewall"
+ ],
+ "severity": "Medium",
+ "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)",
+ "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "checklist": "WAF checklist",
+ "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure",
+ "service": "SAP",
"services": [
- "Entra",
+ "SAP",
+ "AppGW",
"WAF"
],
"severity": "Medium",
- "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.",
- "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html",
"waf": "Security"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
- "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
- "service": "Front Door",
+ "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
"services": [
+ "ACR",
+ "WAF",
"FrontDoor",
- "AzurePolicy",
- "WAF"
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Deploy your WAF policy for Front Door in 'Prevention' mode.",
+ "severity": "Medium",
+ "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
+ "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/",
"waf": "Security"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
- "service": "Front Door",
+ "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "SAP",
"services": [
- "TrafficManager",
+ "AppGW",
+ "WAF",
"FrontDoor",
- "WAF"
+ "AzurePolicy"
],
- "severity": "High",
- "text": "Avoid combining Azure Traffic Manager and Azure Front Door.",
+ "severity": "Medium",
+ "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
"waf": "Security"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
- "service": "Front Door",
+ "guid": "5ada4332-4e13-4811-9231-81aa41742694",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "SAP",
"services": [
- "FrontDoor",
- "WAF"
+ "AppGW",
+ "WAF",
+ "LoadBalancer"
],
- "severity": "High",
- "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.",
+ "severity": "Medium",
+ "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant",
- "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
- "service": "Front Door",
+ "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde",
+ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
+ "service": "SAP",
"services": [
- "FrontDoor",
- "WAF"
+ "ACR",
+ "SAP",
+ "WAF",
+ "VWAN"
],
- "severity": "Low",
- "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.",
+ "severity": "Medium",
+ "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door",
"waf": "Performance"
},
{
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
- "service": "Front Door",
+ "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "SAP",
"services": [
- "FrontDoor",
- "WAF"
+ "Storage",
+ "VNet",
+ "WAF",
+ "PrivateLink",
+ "ACR",
+ "Backup"
],
"severity": "Medium",
- "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.",
- "waf": "Reliability"
+ "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId",
- "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
- "service": "Front Door",
+ "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
+ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat",
+ "service": "SAP",
"services": [
- "FrontDoor",
+ "VM",
+ "SAP",
"WAF"
],
- "severity": "Low",
- "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.",
+ "severity": "High",
+ "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.",
+ "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations",
"waf": "Performance"
},
{
- "ammp": true,
- "arm-service": "Microsoft.Network/loadBalancers",
"checklist": "WAF checklist",
- "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant",
- "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75",
- "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity",
- "service": "Load Balancer",
+ "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
+ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview",
+ "service": "SAP",
"services": [
- "LoadBalancer",
+ "WAF",
+ "LoadBalancer"
+ ],
+ "severity": "Medium",
+ "text": "Make sure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR). This setting (Enabling Floating IP) will reduce latency when internal load balancer configurations are used for high-availability configurations on the DBMS layer.",
+ "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations",
+ "waf": "Security"
+ },
+ {
+ "checklist": "WAF checklist",
+ "guid": "6791f893-5ada-4433-84e1-3811523181aa",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "SAP",
+ "services": [
+ "VM",
+ "VNet",
+ "SAP",
"WAF"
],
- "severity": "High",
- "text": "Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability",
- "waf": "Reliability"
+ "severity": "Medium",
+ "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.",
+ "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations",
+ "waf": "Security"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId",
- "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
- "service": "Front Door",
+ "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
"services": [
- "AKV",
- "Cost",
- "FrontDoor",
+ "VNet",
+ "SAP",
"WAF"
],
"severity": "High",
- "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.",
- "waf": "Operations"
+ "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
- "service": "Front Door",
+ "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios",
+ "service": "SAP",
"services": [
- "FrontDoor",
+ "SAP",
"WAF"
],
"severity": "Medium",
- "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
- "waf": "Operations"
+ "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.",
+ "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups",
+ "waf": "Performance"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
- "service": "Front Door",
+ "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
"services": [
- "FrontDoor",
+ "SAP",
"WAF"
],
"severity": "High",
- "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.",
- "waf": "Security"
+ "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
- "service": "Front Door",
+ "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2",
+ "link": "https://me.sap.com/notes/2015553",
+ "service": "SAP",
"services": [
- "FrontDoor",
- "WAF"
+ "VNet",
+ "SAP",
+ "WAF",
+ "Cost"
],
- "severity": "Medium",
- "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.",
- "waf": "Security"
+ "severity": "High",
+ "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity",
+ "waf": "Cost"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
- "service": "Front Door",
+ "guid": "402a9846-d515-4061-aff8-cd30088693fa",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel",
+ "service": "SAP",
"services": [
- "FrontDoor",
- "WAF"
+ "WAF",
+ "LoadBalancer"
],
"severity": "High",
- "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.",
- "waf": "Security"
+ "text": "If using Load Balancer with Linux guest operating systems, check that the Linux network parameter net.ipv4.tcp_timestamps is set to 0.",
+ "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations",
+ "waf": "Performance"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
- "service": "Front Door",
+ "guid": "87585797-5551-4d53-bb7d-a94ee415734d",
+ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration",
+ "service": "SAP",
"services": [
- "FrontDoor",
+ "VNet",
+ "SAP",
"WAF"
],
- "severity": "High",
- "text": "Tune the Azure Front Door WAF for your workload. Reduce false positive detections.",
+ "severity": "Medium",
+ "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering",
"waf": "Security"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
- "service": "Front Door",
+ "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a",
+ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about",
+ "service": "SAP",
"services": [
- "FrontDoor",
- "AzurePolicy",
- "WAF"
+ "VM",
+ "SAP",
+ "WAF",
+ "Backup"
],
"severity": "High",
- "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.",
- "waf": "Security"
+ "text": "Review SAP HANA database backups for Azure VMs.",
+ "waf": "Cost"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
- "service": "Front Door",
+ "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot",
+ "service": "SAP",
"services": [
- "FrontDoor",
- "WAF"
+ "Monitor",
+ "SAP",
+ "WAF",
+ "ASR"
],
- "severity": "High",
- "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Review Site Recovery built-in monitoring, where used for SAP.",
+ "waf": "Cost"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
- "service": "Front Door",
+ "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf",
+ "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US",
+ "service": "SAP",
"services": [
- "FrontDoor",
+ "Monitor",
+ "SAP",
"WAF"
],
"severity": "High",
- "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.",
- "waf": "Security"
+ "text": "Review the Monitoring the SAP HANA System Landscape guidance.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
- "service": "Front Door",
+ "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies",
+ "service": "SAP",
"services": [
- "FrontDoor",
- "WAF"
+ "VM",
+ "WAF",
+ "Backup"
],
"severity": "Medium",
- "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
- "waf": "Security"
+ "text": "Review Oracle Database in Azure Linux VM backup strategies.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
- "service": "Front Door",
+ "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962",
+ "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16",
+ "service": "SAP",
"services": [
- "FrontDoor",
+ "Storage",
+ "SQL",
"WAF"
],
"severity": "Medium",
- "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
- "waf": "Security"
+ "text": "Review the use of Azure Blob Storage with SQL Server 2016.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
- "service": "Front Door",
+ "guid": "b82e650f-676d-417d-994d-fc33ca54ec14",
+ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql",
+ "service": "SAP",
"services": [
- "FrontDoor",
- "WAF"
+ "VM",
+ "WAF",
+ "Backup"
],
"severity": "Medium",
- "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ",
- "waf": "Security"
+ "text": "Review the use of Automated Backup v2 for Azure VMs.",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
- "service": "Front Door",
+ "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d",
+ "service": "SAP",
"services": [
"WAF"
],
- "severity": "Low",
- "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
- "waf": "Security"
+ "severity": "High",
+ "text": "Enabling Write accelerator for M series when using premium disks(V1)",
+ "waf": "Operations"
},
{
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
- "service": "Front Door",
+ "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94",
+ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test",
+ "service": "SAP",
"services": [
- "FrontDoor",
"WAF"
],
"severity": "Medium",
- "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
- "waf": "Security"
+ "text": "Test availability zone latency.",
+ "waf": "Performance"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id",
- "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection",
- "service": "App Gateway",
+ "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d",
+ "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html",
+ "service": "SAP",
"services": [
- "AppGW",
+ "SAP",
"WAF"
],
- "severity": "High",
- "text": "Enable the Azure Application Gateway WAF bot protection rule set The bot rules detect good and bad bots.",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Activate SAP EarlyWatch Alert for all SAP components.",
+ "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html",
+ "waf": "Performance"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection",
- "service": "App Gateway",
+ "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017",
+ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456",
+ "service": "SAP",
"services": [
- "AppGW",
- "AzurePolicy",
+ "SAP",
"WAF"
],
- "severity": "High",
- "text": "Enable request body inspection feature enabled in Azure Application Gateway WAF policy.",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.",
+ "training": "https://me.sap.com/notes/0002879613",
+ "waf": "Performance"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf",
- "service": "App Gateway",
+ "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80",
+ "service": "SAP",
"services": [
- "AppGW",
+ "Monitor",
+ "SQL",
"WAF"
],
- "severity": "High",
- "text": "Tune the Azure Application Gateway WAF for your workload. Reduce false positive detections.",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Review SQL Server performance monitoring using CCMS.",
+ "waf": "Performance"
},
{
- "ammp": true,
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
- "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
- "service": "App Gateway",
+ "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390",
+ "link": "https://me.sap.com/notes/500235",
+ "service": "SAP",
"services": [
- "AppGW",
- "AzurePolicy",
+ "VM",
+ "SAP",
"WAF"
],
- "severity": "High",
- "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).",
+ "training": "https://me.sap.com/notes/1100926/E",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview",
- "service": "App Gateway",
+ "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43",
+ "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot",
+ "service": "SAP",
"services": [
- "AppGW",
+ "Monitor",
+ "SAP",
"WAF"
],
"severity": "Medium",
- "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
- "waf": "Security"
+ "text": "Review SAP HANA studio alerts.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details",
- "service": "App Gateway",
+ "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694",
+ "link": "https://me.sap.com/notes/1969700",
+ "service": "SAP",
"services": [
- "AppGW",
+ "SAP",
"WAF"
],
"severity": "Medium",
- "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ",
- "waf": "Security"
+ "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.",
+ "waf": "Performance"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "99937189-ff78-492a-b9ca-18d828d82b37",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices",
- "service": "App Gateway",
+ "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
"services": [
+ "VM",
"WAF"
],
- "severity": "Low",
- "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.",
+ "severity": "Medium",
+ "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.",
+ "training": "https://learn.microsoft.com/azure/automation/update-management/overview",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "349a15c1-52f4-4319-9078-3895d95ecafd",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules",
- "service": "App Gateway",
+ "guid": "08951710-79a2-492a-adbc-06d7a401545b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations",
+ "service": "SAP",
"services": [
- "AppGW",
+ "SAP",
"WAF"
],
"severity": "Medium",
- "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
+ "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.",
+ "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions",
- "service": "App Gateway",
+ "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
"services": [
- "AppGW",
+ "SAP",
+ "SQL",
"WAF"
- ],
- "severity": "Medium",
- "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.",
+ ],
+ "severity": "Low",
+ "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "App Gateway",
+ "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "service": "SAP",
"services": [
- "AppGW",
+ "SQL",
"WAF"
],
- "severity": "Medium",
- "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Disable xp_cmdshell. The SQL Server feature xp_cmdshell enables a SQL Server internal operating system command shell. It's a potential risk in security audits.",
+ "training": "https://me.sap.com/notes/3019299/E",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
- "service": "Front Door",
+ "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"services": [
- "FrontDoor",
- "WAF"
+ "Storage",
+ "WAF",
+ "Backup",
+ "SAP",
+ "SQL"
],
- "severity": "Medium",
- "text": "Add diagnostic settings to save your Azure Front Door WAF logs.",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.",
+ "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "92664c60-47e3-4591-8b1b-8d557656e686",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel",
- "service": "App Gateway",
+ "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "SAP",
"services": [
- "Sentinel",
- "AppGW",
+ "Storage",
"WAF"
],
"severity": "Medium",
- "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.",
- "waf": "Operations"
+ "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.",
+ "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "845f5f91-9c21-4674-a725-5ce890850e20",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "Front Door",
+ "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "SAP",
"services": [
- "Sentinel",
- "FrontDoor",
- "WAF"
+ "WAF",
+ "AKV"
],
- "severity": "Medium",
- "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use Azure Key Vault to store your secrets and credentials",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code",
- "service": "App Gateway",
+ "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
+ "service": "SAP",
"services": [
- "AppGW",
- "WAF"
+ "RBAC",
+ "WAF",
+ "Subscriptions",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.",
- "waf": "Operations"
+ "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).",
+ "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview",
- "service": "App Gateway",
+ "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "SAP",
"services": [
- "AzurePolicy",
- "WAF"
+ "WAF",
+ "AKV",
+ "AzurePolicy"
],
"severity": "Medium",
- "text": "Use WAF Policies instead of the legacy WAF configuration.",
- "waf": "Operations"
+ "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88",
- "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway",
- "service": "App Gateway",
+ "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy",
+ "service": "SAP",
"services": [
- "AppGW",
- "VPN",
- "ExpressRoute",
- "VNet",
- "WAF"
+ "RBAC",
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.",
+ "severity": "High",
+ "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed",
+ "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/frontdoors",
"checklist": "WAF checklist",
- "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1",
- "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions",
- "service": "Front Door",
+ "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"services": [
- "FrontDoor",
- "WAF"
+ "Defender",
+ "Storage",
+ "WAF",
+ "SAP"
],
- "severity": "Medium",
- "text": "Make sure your origins only take traffic from your Azure Front Door instance.",
+ "severity": "High",
+ "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.",
+ "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2",
- "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview",
- "service": "App Gateway",
+ "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks",
+ "service": "SAP",
"services": [
+ "Defender",
+ "RBAC",
+ "SAP",
"WAF"
],
"severity": "High",
- "text": "You should encrypt traffic to the backend servers.",
+ "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.",
+ "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/overview",
- "service": "App Gateway",
+ "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"services": [
+ "SAP",
"WAF"
],
- "severity": "High",
- "text": "You should use a Web Application Firewall.",
+ "severity": "Low",
+ "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS",
+ "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2",
- "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview",
- "service": "App Gateway",
+ "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal",
+ "service": "SAP",
"services": [
- "WAF"
+ "WAF",
+ "AKV"
],
"severity": "Medium",
- "text": "Redirect HTTP to HTTPS",
+ "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f",
- "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request",
- "service": "App Gateway",
+ "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
+ "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices",
+ "service": "SAP",
"services": [
- "WAF"
+ "WAF",
+ "AKV"
],
- "severity": "Medium",
- "text": "Use gateway-managed cookies to direct traffic from a user session to the same server for processing",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Use an Azure Key Vault per application per environment per region.",
+ "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings",
- "service": "App Gateway",
+ "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c",
+ "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "WAF",
+ "AKV"
],
"severity": "High",
- "text": "Enable connection draining during planned service updates to prevent connection loss to existing membrs of the backend pool",
+ "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5",
- "link": "https://learn.microsoft.com/azure/application-gateway/custom-error",
- "service": "App Gateway",
+ "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles",
+ "service": "SAP",
"services": [
- "WAF"
+ "RBAC",
+ "SAP",
+ "WAF",
+ "Subscriptions"
],
- "severity": "Low",
- "text": "Create custom error pages to display a personalized user experience",
- "waf": "Operations"
+ "severity": "High",
+ "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1",
- "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url",
- "service": "App Gateway",
+ "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
+ "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/",
+ "service": "SAP",
"services": [
- "WAF"
+ "SAP",
+ "NVA",
+ "WAF",
+ "PrivateLink"
],
- "severity": "Medium",
- "text": "Edit HTTP requests and response headers for easier routing and information exchange between the client and server",
+ "severity": "High",
+ "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources",
+ "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1",
- "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview",
- "service": "App Gateway",
+ "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
+ "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations",
+ "service": "SAP",
"services": [
- "FrontDoor",
+ "VM",
+ "Storage",
"WAF"
],
- "severity": "Medium",
- "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover",
- "waf": "Performance"
+ "severity": "Low",
+ "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.",
+ "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "29dcc19f-a8fa-4c35-8281-290577538793",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "App Gateway",
+ "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
+ "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide",
+ "service": "SAP",
"services": [
+ "Defender",
"WAF"
],
- "severity": "Medium",
- "text": "Use transport layer load balancing",
- "waf": "Performance"
+ "severity": "Low",
+ "text": "For even more powerful protection, consider using Microsoft Defender for Endpoint.",
+ "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations",
+ "waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d",
- "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview",
- "service": "App Gateway",
+ "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525",
+ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape",
+ "service": "SAP",
"services": [
+ "VNet",
+ "SAP",
"WAF"
],
- "severity": "Medium",
- "text": "Configure routing based on host or domain name for multiple web applications on a single gateway",
+ "severity": "High",
+ "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
"checklist": "WAF checklist",
- "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2",
- "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal",
- "service": "App Gateway",
+ "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance",
+ "service": "SAP",
"services": [
- "Entra",
+ "SAP",
"WAF"
],
+ "severity": "Low",
+ "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.",
+ "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations",
+ "waf": "Security"
+ },
+ {
+ "checklist": "WAF checklist",
+ "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc",
+ "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions",
+ "service": "SAP",
+ "services": [
+ "Monitor",
+ "SAP",
+ "WAF",
+ "AKV"
+ ],
"severity": "Medium",
- "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm",
+ "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations",
"waf": "Security"
},
{
- "arm-service": "microsoft.network/applicationGateways",
+ "arm-service": "microsoft.cache/redis",
"checklist": "WAF checklist",
- "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9",
- "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket",
- "service": "App Gateway",
+ "guid": "65285269-440b-44be-9d3e-0844276d4bdc",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy",
+ "service": "Redis",
"services": [
- "AppGW",
+ "ACR",
"WAF"
],
- "severity": "Low",
- "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols",
- "waf": "Security"
+ "severity": "High",
+ "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.DBforPostgreSQL/servers",
+ "arm-service": "microsoft.cache/redis",
"checklist": "WAF checklist",
- "guid": "65285269-441c-44bf-9d3e-0844276d4bdc",
- "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview",
- "service": "PostgreSQL",
+ "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence",
+ "service": "Redis",
"services": [
+ "Storage",
"WAF"
],
"severity": "Medium",
- "text": "Leverage Flexible Server",
+ "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DBforPostgreSQL/servers",
+ "arm-service": "microsoft.cache/redis",
"checklist": "WAF checklist",
- "guid": "016ccf31-ae5a-41eb-9888-9535e227896d",
- "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview#architecture-and-high-availability",
- "service": "PostgreSQL",
+ "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c",
+ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence",
+ "service": "Redis",
"services": [
+ "Storage",
"WAF"
],
- "severity": "High",
- "text": "Leverage Availability Zones where regionally applicable",
+ "severity": "Medium",
+ "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available",
"waf": "Reliability"
},
{
- "arm-service": "Microsoft.DBforPostgreSQL/servers",
+ "arm-service": "microsoft.cache/redis",
"checklist": "WAF checklist",
- "guid": "31b67c67-be59-4519-8083-845d587cb391",
- "link": "https://learn.microsoft.com/azure/postgresql/single-server/concepts-business-continuity#cross-region-read-replicas",
- "service": "PostgreSQL",
+ "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789",
+ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication",
+ "service": "Redis",
"services": [
+ "ASR",
"WAF"
],
"severity": "Medium",
- "text": "Leverage cross-region read replicas for BCDR",
+ "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.",
"waf": "Reliability"
},
{
@@ -34071,8 +37590,8 @@
"link": "https://learn.microsoft.com/azure/data-factory/source-control",
"service": "Azure Data Factory",
"services": [
- "Backup",
- "WAF"
+ "WAF",
+ "Backup"
],
"severity": "Medium",
"text": "Use DevOps to Backup the ARM templates with Github/Azure DevOps integration ",
@@ -34114,986 +37633,1019 @@
"link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
"service": "Azure Data Factory",
"services": [
- "AKV",
- "WAF"
+ "WAF",
+ "AKV"
],
"severity": "Low",
"text": "If using Keyvault integration, use SLA of Keyvault to understand your availablity",
"waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.DBforMySQL/servers",
"checklist": "WAF checklist",
- "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.",
- "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e",
- "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention",
- "service": "ACR",
+ "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview",
+ "service": "Azure MySQL",
"services": [
- "ACR",
"WAF"
],
- "severity": "High",
- "text": "Disable Azure Container Registry image export",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Leverage Flexible Server",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.DBforMySQL/servers",
"checklist": "WAF checklist",
- "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry",
- "guid": "d503547c-d447-4e82-9128-a7100f1cac6d",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy",
- "service": "ACR",
+ "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones",
+ "service": "Azure MySQL",
"services": [
- "ACR",
- "AzurePolicy",
"WAF"
],
"severity": "High",
- "text": "Enable Azure Policies for Azure Container Registry",
- "waf": "Security"
+ "text": "Leverage Availability Zones where regionally applicable",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.DBforMySQL/servers",
"checklist": "WAF checklist",
- "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.",
- "guid": "d345293c-7639-4637-a551-c5c04e401955",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push",
- "service": "ACR",
+ "guid": "1e944a45-9c37-43e7-bd61-623b365a917e",
+ "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication",
+ "service": "Azure MySQL",
"services": [
- "AKV",
- "ACR",
"WAF"
],
+ "severity": "Medium",
+ "text": "Leverage Data-in replication for cross-region DR scenarios",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "services": [
+ "WAF",
+ "AKV",
+ "Backup"
+ ],
"severity": "High",
- "text": "Sign and Verify containers with notation (Notary v2)",
- "waf": "Security"
+ "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.",
- "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49",
- "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys",
- "service": "ACR",
+ "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance",
+ "service": "Key Vault",
"services": [
"ACR",
- "AKV",
- "WAF"
+ "WAF",
+ "AKV"
],
"severity": "Medium",
- "text": "Encrypt registry with a customer managed key",
- "waf": "Security"
+ "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications",
- "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
- "service": "ACR",
+ "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication",
+ "service": "Key Vault",
"services": [
- "Entra",
- "RBAC",
- "ACR",
- "WAF"
+ "WAF",
+ "AKV"
],
- "severity": "High",
- "text": "Use Managed Identities to connect instead of Service Principals",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. Familiarize yourself with the Key Vault's data replication.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions",
+ "service": "Key Vault",
+ "services": [
+ "WAF",
+ "AKV",
+ "AzurePolicy"
+ ],
+ "severity": "Medium",
+ "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "WAF checklist",
+ "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations",
+ "service": "Key Vault",
+ "services": [
+ "Storage",
+ "WAF",
+ "Subscriptions",
+ "AKV",
+ "Backup"
+ ],
+ "severity": "Medium",
+ "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead",
- "guid": "be0e38ce-e297-411b-b363-caaab79b198d",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
- "service": "ACR",
+ "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
"services": [
- "RBAC",
- "WAF"
+ "WAF",
+ "AKV"
],
"severity": "High",
- "text": "Disable local authentication for management plane access",
- "waf": "Security"
+ "text": "If you want protection against accidental or malicious deletion of your secrets, configure soft-delete and purge protection features on your key vault.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations",
- "guid": "387e5ced-126c-4d13-8af5-b20c6998a646",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli",
- "service": "ACR",
+ "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview",
+ "service": "Key Vault",
"services": [
- "Entra",
- "RBAC",
- "ACR",
- "WAF"
+ "WAF",
+ "AKV"
],
- "severity": "High",
- "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Key Vault's soft-deleted resources are retained for a set period of 90 calendar days. Familiarize yourself with the Key Vault's soft-delete guidance.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "description": "Disable anonymous pull/push access",
- "guid": "e338997e-41c7-47d7-acf6-a62a1194956d",
- "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access",
- "service": "ACR",
+ "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
"services": [
- "WAF"
+ "WAF",
+ "AKV",
+ "Backup"
],
- "severity": "Medium",
- "text": "Disable Anonymous pull access",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token",
- "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli",
- "service": "ACR",
+ "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations",
+ "service": "Key Vault",
"services": [
- "Entra",
- "WAF"
+ "WAF",
+ "AKV",
+ "Backup"
],
- "severity": "High",
- "text": "Disable repository-scoped access tokens",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.KeyVault/vaults",
"checklist": "WAF checklist",
- "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network",
- "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee",
- "service": "ACR",
+ "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection",
+ "service": "Key Vault",
"services": [
- "PrivateLink",
"EventHubs",
- "ACR",
- "WAF"
+ "WAF",
+ "AKV"
],
- "severity": "High",
- "text": "Deploy images from a trusted environment",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Purge protection is recommended when using keys for encryption to prevent data loss. Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI, PowerShell or Portal.",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.Compute/virtualMachineScaleSets",
"checklist": "WAF checklist",
- "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR",
- "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy",
- "service": "ACR",
+ "description": "Automatic instance repairs ensure that unhealthy instances are promptly identified and replaced, maintaining a set of healthy instances within your scale set.",
+ "guid": "7e13c105-675c-41e9-95b4-59837ff7ae7c",
+ "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs",
+ "service": "VMSS",
"services": [
- "Entra",
- "ACR",
- "AzurePolicy",
+ "VM",
"WAF"
],
- "severity": "Medium",
- "text": "Disable Azure ARM audience tokens for authentication",
- "waf": "Security"
+ "severity": "Low",
+ "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.",
- "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6",
- "link": "https://learn.microsoft.com/azure/container-registry/monitor-service",
- "service": "ACR",
+ "description": "Ensure that Azure Backup is utilized appropriately to meet your organization's resiliency requirements for Azure virtual machines (VMs).",
+ "guid": "4d874a74-8b66-42d6-b150-512a66498f6d",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction",
+ "service": "VM",
"services": [
- "Entra",
- "ACR",
- "Monitor",
- "WAF"
+ "VM",
+ "WAF",
+ "Backup"
],
- "severity": "Medium",
- "text": "Enable diagnostics logging",
- "waf": "Security"
+ "severity": "High",
+ "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch",
- "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
- "service": "ACR",
+ "description": "Single Instance VMs using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks are guaranteed to have Virtual Machine Connectivity of at least 99.9%",
+ "guid": "8052d88e-79d1-47b7-9b22-a5a67e7a8ed4",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
+ "service": "VM",
"services": [
- "PrivateLink",
- "VNet",
- "Firewall",
+ "VM",
"WAF"
],
- "severity": "Medium",
- "text": "Control inbound network access with Private Link",
- "waf": "Security"
+ "severity": "High",
+ "text": "Use Premium or Ultra disks for production VMs",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "Disable public network access if inbound network access is secured using Private Link",
- "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access",
- "service": "ACR",
+ "description": "Azure automatically replicates managed disks within a region to ensure data durability and protect against single-point failures.",
+ "guid": "b31e38c3-f298-412b-8363-cffe179b599d",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview",
+ "service": "VM",
"services": [
- "PrivateLink",
+ "VM",
"WAF"
],
- "severity": "Medium",
- "text": "Disable Public Network access",
- "waf": "Security"
+ "severity": "High",
+ "text": "Ensure Managed Disks are used for all VMs",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "Only the ACR Premium SKU supports Private Link access",
- "guid": "fc833934-8b26-42d6-ac5f-512925498f6d",
- "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus",
- "service": "ACR",
+ "description": "Temporary disks are intended for short-term storage of non-persistent data such as page files, swap files, or SQL Server tempdb. Storing persistent data on temporary disks can lead to data loss during maintenance events or VM redeployment.",
+ "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk",
+ "service": "VM",
"services": [
- "PrivateLink",
- "ACR",
+ "VM",
+ "Storage",
+ "SQL",
"WAF"
],
"severity": "Medium",
- "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)",
- "waf": "Security"
+ "text": "Do not use the Temp disk for anything that is not acceptable to be lost",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities",
- "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a",
- "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
- "service": "ACR",
+ "description": "Co-locate your compute, storage, networking, and data resources across an availability zone, and replicate this arrangement in other availability zones.",
+ "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e",
+ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
+ "service": "VM",
"services": [
+ "VM",
"ACR",
- "Defender",
+ "Storage",
"WAF"
],
- "severity": "Low",
- "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities",
- "waf": "Security"
+ "severity": "Medium",
+ "text": "Leverage Availability Zones for your VMs in regions where they are supported",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.",
- "guid": "4451e1a2-d345-4293-a763-9637a551c5c0",
- "service": "ACR",
+ "description": "Use at least two VMs in Availability Sets to isolate VMs on different fault and update domains.",
+ "guid": "5a785d6f-e96c-496a-b884-4cf3b2b38c88",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview",
+ "service": "VM",
"services": [
+ "VM",
"WAF"
],
"severity": "Medium",
- "text": "Deploy validated container images",
- "waf": "Security"
+ "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerregistry/registries",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.",
- "guid": "4e401955-387e-45ce-b126-cd132af5b20c",
- "service": "ACR",
+ "description": "Azure provides multiple options for VM redundancy to meet different requirements (Availability Zones, Virtual Machine Scale Sets, Availability Sets, Azure Site Recovery)",
+ "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
+ "service": "VM",
"services": [
+ "VM",
+ "ASR",
"WAF"
],
"severity": "High",
- "text": "Use up-to-date platforms, languages, protocols and frameworks",
- "waf": "Security"
+ "text": "Avoid running a production workload on a single VM",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Insights/components",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20",
- "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models",
- "service": "Azure Monitor",
+ "description": "Azure Site Recovery enables you to achieve low RTO (Recovery Time Objective) for your Azure and hybrid VMs by providing continuous replication and failover capabilities.",
+ "guid": "2a6bcca2-b5fe-4a1e-af3d-d95d48c7c891",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "VM",
"services": [
- "Monitor",
- "WAF"
+ "VM",
+ "ASR",
+ "WAF",
+ "AVS"
],
- "severity": "Medium",
- "text": "Data collection rules in Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "Cost"
+ "severity": "High",
+ "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "guid": "45901365-d38e-443f-abcb-d868266abca2",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
- "service": "Azure Backup",
+ "description": "By using Capacity Reservations, you can effectively manage capacity for critical workloads, ensuring resource availability in specified regions.",
+ "guid": "bd7bb012-f7b9-45e0-9e15-8e3ea3992c2d",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/capacity-reservation-overview",
+ "service": "VM",
"services": [
- "Backup",
"WAF"
],
- "severity": "Medium",
- "text": "check backup instances with the underlying datasource not found",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Use Capacity Reservations for critical workloads that require guaranteed capacity",
+ "waf": "Reliability"
},
{
"arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "description": "By ensuring that the necessary quotas are increased in your DR region before testing failover with ASR, you can avoid any potential resource constraints during the recovery process for failed over VMs.",
+ "guid": "e6e2065b-3a76-4af4-a691-e8939ada4666",
+ "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests",
"service": "VM",
"services": [
+ "VM",
+ "ASR",
"WAF"
],
"severity": "Medium",
- "text": "Delete or archive unassociated services (disks, nics, ip addresses etc)",
- "waf": "Cost"
+ "text": "Increase quotas in DR region before testing failover with ASR",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
+ "arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
- "service": "Azure Backup",
+ "description": "Scheduled Events is an Azure Metadata Service that provides information about upcoming maintenance events for virtual machines (VMs). By leveraging Scheduled Events, you can proactively prepare your applications for VM maintenance, minimizing disruption and improving the availability of your VMs.",
+ "guid": "6d3b475a-5c7a-4cbe-99bb-e64dd8902e87",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events",
+ "service": "VM",
"services": [
- "Storage",
- "Backup",
- "ASR",
+ "VM",
"WAF"
],
- "severity": "Medium",
- "text": "Consider a good balance between site recovery storage and backup for non mission critical applications",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Utilize Scheduled Events to prepare for VM maintenance",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Insights/components",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a",
- "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts",
- "service": "Azure Monitor",
+ "description": "Use Zone-redundant Storage (ZRS) in the primary region for scenarios that require high availability and for restricting replication to a particular country or region. For protection against regional disasters, use Geo-zone-redundant Storage (GZRS), which combines ZRS in the primary region with geo-replication to a secondary region?.",
+ "guid": "48c7c891-dcb1-4f7d-9769-ae568ba38d4a",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
"services": [
- "Monitor",
+ "Storage",
"WAF"
],
"severity": "Medium",
- "text": "Check spending and savings opportunities among the 40 different log analytics workspaces- use different retention and data collection for nonprod workspaces-create daily cap for awareness and tier sizing - If you do set a daily cap, in addition to creating an alert when the cap is reached,ensure that you also create an alert rule to be notified when some percentage has been reached (90% for example). - consider workspace transformation if possible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes",
- "waf": "Cost"
+ "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Insights/components",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Azure Monitor",
+ "description": "Assigning a Delete lock to your storage account helps protect the availability of your data, minimizing the risk of disruptions to your business operations.",
+ "guid": "85e2213d-bd7b-4b01-8f7b-95e06e158e3e",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
"services": [
"Storage",
- "AzurePolicy",
"WAF"
],
- "severity": "Medium",
- "text": "Enforce a purging log policy and automation (if needed, logs can be moved to cold storage)",
- "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "VM",
+ "description": "Container soft delete protects your data from being accidentally deleted by maintaining the deleted data in the system for a specified period of time.",
+ "guid": "a3992c2d-e6e2-4065-a3a7-6af4a691e893",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
"services": [
"Storage",
- "Backup",
"WAF"
],
- "severity": "Medium",
- "text": "Check that the disks are really needed, if not: delete. If they are needed, find lower storage tiers or use backup -",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Enable soft delete for Storage Account Containers",
+ "waf": "Reliability"
},
{
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "WAF checklist",
- "guid": "d1e44a19-659d-4395-afd7-7289b835556d",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations",
- "service": "Storage",
+ "description": "Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time.",
+ "guid": "9ada4666-7e13-4c10-96b9-153d89f89dc7",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
"services": [
"Storage",
- "AzurePolicy",
"WAF"
],
- "severity": "Medium",
- "text": "Consider moving unused storage to lower tier, with customized rule - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Enable soft delete for blobs",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
"checklist": "WAF checklist",
- "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "VM",
+ "description": "Azure Backup enhanced soft delete provides critical protection against ransomware attacks by retaining deleted backups, enabling recovery from potential ransomware encryption or deletion.",
+ "guid": "b44be3b1-a27f-48b9-b91b-e1038df03a82",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about",
+ "service": "Azure Backup",
"services": [
- "VM",
- "WAF"
+ "WAF",
+ "Backup"
],
"severity": "Medium",
- "text": "Make sure advisor is configured for VM right sizing ",
- "waf": "Cost"
+ "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
"checklist": "WAF checklist",
- "description": "check by searching the Meter Category Licenses in the Cost analysys",
- "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations",
- "service": "VM",
+ "description": "Azure Backup's multi-user authorization enables fine-grained control over user access to backup resources, allowing you to restrict privileges and ensure proper authentication and authorization for backup operations.",
+ "guid": "2cd463cb-bbc8-4ac2-a9eb-c92a43da1dae",
+ "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept",
+ "service": "Azure Backup",
"services": [
- "VM",
- "Cost",
- "AzurePolicy",
- "WAF"
+ "WAF",
+ "Backup"
],
- "severity": "Medium",
- "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.RecoveryServices/vaults",
"checklist": "WAF checklist",
- "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3",
- "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
- "service": "VM",
+ "description": "Azure Immutable Storage provides an additional layer of security by ensuring that backup data stored in the vault cannot be modified or deleted for a specified retention period. This helps safeguard your backups from ransomware attacks that may attempt to compromise or manipulate your backup data.",
+ "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e",
+ "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault",
+ "service": "Azure Backup",
"services": [
- "LoadBalancer",
+ "Storage",
+ "WAF",
+ "Backup"
+ ],
+ "severity": "Low",
+ "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "WAF checklist",
+ "description": "To eliminate a single point of failure in your on-premises DNS services and ensure reliable DNS resolution during business continuity and disaster recovery scenarios, it is recommended to utilize Azure DNS Private Resolvers in multiple regions. By deploying two or more Azure DNS private resolvers across different regions, you can enable DNS failover and achieve resiliency in your DNS infrastructure.",
+ "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146",
+ "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover",
+ "service": "DNS",
+ "services": [
+ "DNS",
+ "ASR",
+ "WAF",
+ "ACR"
+ ],
+ "severity": "Low",
+ "text": "Implement DNS Failover using Azure DNS Private Resolvers",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.PowerBI/gateways",
+ "checklist": "WAF checklist",
+ "description": "Use an on-premises data gateway cluster to avoid single points of failure and to load balance traffic across gateways.",
+ "guid": "89f89dc7-b44b-4e3b-8a27-f8b9e91be103",
+ "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters",
+ "service": "Data Gateways",
+ "services": [
+ "ACR",
"WAF"
],
"severity": "Medium",
- "text": " this can be also put under AHUB if you already have licenses https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance",
- "waf": "Cost"
+ "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data",
+ "waf": "Reliability"
},
{
"arm-service": "Microsoft.Compute/virtualMachines",
"checklist": "WAF checklist",
- "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5",
- "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
- "service": "VM",
+ "description": "When choosing the best option for deploying NVAs in Azure, it is crucial to consider the vendor's recommendations and validate that the specific design has been vetted and validated by the NVA vendor. The vendor should also provide the necessary NVA configuration for seamless integration in Azure.",
+ "guid": "8b1188b3-c6a4-46ce-a544-451e192d3442",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
+ "service": "NVA",
"services": [
- "VM",
+ "NVA",
"WAF"
],
- "severity": "Medium",
- "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)",
- "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management",
- "waf": "Cost"
+ "severity": "High",
+ "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
- "service": "VM",
+ "guid": "1fc2fc14-eea6-4e69-b8d9-a3edc218e687",
+ "link": "https://polite-sea-0995b240f.2.azurestaticapps.net/technical-delivery-playbook/azure-services/analytics/purview/",
+ "service": "Purview",
"services": [
- "ARS",
- "VM",
- "Cost",
"WAF"
],
"severity": "Medium",
- "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.",
- "waf": "Cost"
+ "text": "Leverage FTA Resillency Handbook",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d",
- "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
- "service": "VM",
+ "guid": "ab067acb-49e5-4b96-8332-4ecf8cc13318",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Only larger disks can be reserved => 1 TiB -",
- "waf": "Cost"
+ "severity": "High",
+ "text": "Plan for Data Center level outage",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db",
- "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
- "service": "VM",
+ "description": "1. Create the new account 2. Migrate configuration items 3. Run scans 4. Migrate custom typedefs and custom assets 5. Migrate relationships 6. Migrate glossary terms 7. Assign classifications to assets 8. Assign contacts to assets",
+ "guid": "da611702-69f4-4fb4-aa3d-3ef7f3176c4b",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "After the right-sizing optimization",
- "waf": "Cost"
+ "text": "Practice Failover for BCDR",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Sql/servers",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de",
- "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
- "service": "Azure SQL",
+ "guid": "97b15b8a-219a-44ab-bb57-879024d22678",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"services": [
- "AzurePolicy",
- "SQL",
- "Cost",
- "WAF"
+ "WAF",
+ "Backup"
],
- "severity": "Medium",
- "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations",
- "waf": "Cost"
+ "severity": "High",
+ "text": "Plan a backup strategy and take regular backups",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667",
- "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
- "service": "VM",
+ "guid": "6d20b56c-56a9-4581-89bf-8d8e5c586b7d",
+ "link": "https://learn.microsoft.com/purview/manage-kafka-dotnet",
+ "service": "Purview",
"services": [
- "VM",
+ "EventHubs",
"WAF"
],
- "severity": "Medium",
- "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Use Microsoft Purview's Event Hubs to subscribe and create entities to another account",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
- "service": "VM",
+ "guid": "8cdc15ac-c075-4ee9-a130-a8889579e76b",
+ "link": "https://learn.microsoft.com/purview/deployment-best-practices",
+ "service": "Purview",
"services": [
- "VM",
"WAF"
],
"severity": "Medium",
- "text": "Consider using a VMSS to match demand rather than flat sizing",
- "waf": "Cost"
+ "text": "Follow Purview accounts architectures and deployment best practices",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.containerservice/managedClusters",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc",
- "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure",
- "service": "AKS",
+ "guid": "896e710a-7da7-4be9-a56d-14d3c49d997c",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-collections",
+ "service": "Purview",
"services": [
- "AKS",
"WAF"
],
"severity": "Medium",
- "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)",
- "waf": "Cost"
+ "text": "Follow Collection Architectures and best practices",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
- "service": "Azure Backup",
+ "guid": "b3d1325a-a225-4c6f-9e06-85edddea8a4b",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-asset-lifecycle",
+ "service": "Purview",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Move recovery points to vault-archive where applicable (Validate)",
- "training": "https://azure.microsoft.com/pricing/reservations/",
- "waf": "Cost"
+ "text": "Follow Assest lifecycle best practices",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Databricks/workspaces",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2",
- "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination",
- "service": "Databricks",
+ "guid": "7cdeb3c6-1fc2-4fc1-9eea-6e69d8d9a3ed",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-automation",
+ "service": "Purview",
"services": [
- "LoadBalancer",
- "VM",
"WAF"
],
"severity": "Medium",
- "text": "Consider using Spot VMs with fallback where possible. Consider autotermination of clusters.",
- "waf": "Cost"
+ "text": "Follow automation best practices",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "cc881470-607c-41cc-a0e6-14658dd458e9",
- "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
- "service": "Azure Functions",
+ "guid": "c218e687-ab06-47ac-a49e-5b9603324ecf",
+ "link": "https://learn.microsoft.com/purview/disaster-recovery",
+ "service": "Purview",
"services": [
- "WAF"
+ "WAF",
+ "Backup"
],
"severity": "Medium",
- "text": "Functions - Reuse connections",
- "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json",
- "waf": "Cost"
+ "text": "Follow Backup and Migration Best practices",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f",
- "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
- "service": "Azure Functions",
+ "guid": "8cc13318-da61-4170-869f-4fb4aa3d3ef7",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-glossary",
+ "service": "Purview",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Functions - Cache data locally",
- "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
- "waf": "Cost"
+ "text": "Follow Purview Glossary Best Practices",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac",
- "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
- "service": "Azure Functions",
+ "guid": "f3176c4b-97b1-45b8-a219-a4abeb578790",
+ "link": "https://learn.microsoft.com/purview/concept-workflow",
+ "service": "Purview",
"services": [
- "Storage",
"WAF"
],
- "severity": "Medium",
- "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.",
- "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Leverage Workflows ",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a",
- "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
- "service": "Azure Functions",
+ "guid": "24d22678-6d20-4b56-a56a-958119bf8d8e",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-security",
+ "service": "Purview",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Functions - Keep your functions warm",
- "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
- "waf": "Cost"
+ "text": "Follow Purview Security Best Practices",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e",
- "link": "https://learn.microsoft.com/azure/governance/policy/overview",
- "service": "Azure Functions",
+ "guid": "5c586b7d-8cdc-415a-ac07-5ee9b130a888",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-lineage-azure-data-factory",
+ "service": "Purview",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "When using autoscale with different functions, there might be one driving all the autoscale for all the resources - consider moving it to a separate consumption plan (and consider higher plan for CPU)",
- "waf": "Cost"
+ "text": "Follow Purview Data Lineage Best Practices",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8",
- "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
- "service": "Azure Functions",
+ "guid": "9579e76b-896e-4710-a7da-7be9956d14d3",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-scanning",
+ "service": "Purview",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Function apps in a given plan are all scaled together, so any issues with scaling can affect all apps in the plan.",
- "waf": "Cost"
+ "text": "Follow Best Practices for Scanning Registered Sources",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Web/sites",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38",
- "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
- "service": "Azure Functions",
+ "guid": "c49d997c-b3d1-4325-aa22-5c6f4e0685ed",
+ "link": "https://learn.microsoft.com/purview/concept-best-practices-classification",
+ "service": "Purview",
"services": [
"WAF"
],
"severity": "Medium",
- "text": "Am I billed for 'await time'? This question is typically asked in the context of a C# function that does an async operation and waits for the result, e.g. await Task.Delay(1000) or await client.GetAsync('http://google.com'). The answer is yes - the GB second calculation is based on the start and end time of the function and the memory usage over that period. What actually happens over that time in terms of CPU activity is not factored into the calculation.One exception to this rule is if you are using durable functions. You are not billed for time spent at awaits in orchestrator functions.apply demand shaping techinques where possible (dev environments?) https://github.com/Azure-Samples/functions-csharp-premium-scaler",
- "waf": "Cost"
+ "text": "Follow Classification Best Practices in Governance Portal",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465",
- "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
- "service": "Front Door",
+ "guid": "ddea8a4b-7cde-4b3c-91fc-2fc14eea6e69",
+ "link": "https://learn.microsoft.com/purview/sensitivity-labels-frequently-asked-questions",
+ "service": "Purview",
"services": [
- "EventHubs",
- "FrontDoor",
"WAF"
],
"severity": "Medium",
- "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.",
- "waf": "Cost"
+ "text": "Perform Sensitivity Labelling in the Purview Data Map",
+ "waf": "Reliability"
},
{
- "arm-service": "microsoft.network/frontdoors",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
- "service": "Front Door",
+ "guid": "d8d9a3ed-c218-4e68-9ab0-67acb49e5b96",
+ "link": "https://learn.microsoft.com/purview/concept-data-share",
+ "service": "Purview",
"services": [
- "AppSvc",
- "FrontDoor",
+ "Storage",
"WAF"
],
- "severity": "Medium",
- "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3",
- "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
- "service": "Storage",
+ "guid": "03324ecf-8cc1-4331-ada6-1170269f4fb4",
+ "link": "https://learn.microsoft.com/purview/concept-insights",
+ "service": "Purview",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Consider archiving tiers for less used data",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Leverage Data Estate Insights",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c",
- "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
- "service": "VM",
+ "guid": "aa3d3ef7-f317-46c4-a97b-15b8a219a4ab",
+ "link": "https://learn.microsoft.com/purview/catalog-adoption-insights",
+ "service": "Purview",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Check disk sizes where the size does not match the tier (i.e. A 513 GiB disk will pay a P30 (1TiB) and consider resizing",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Use Data stewardship and Catalog adoption",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2",
- "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
- "service": "Storage",
+ "guid": "eb578790-24d2-4267-a6d2-0b56c56a9581",
+ "link": "https://learn.microsoft.com/purview/concept-insights",
+ "service": "Purview",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Consider using standard SSD rather than Premium or Ultra where possible",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Use Inventory and Ownership",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
- "service": "Storage",
+ "guid": "19bf8d8e-5c58-46b7-b8cd-c15acc075ee9",
+ "link": "https://learn.microsoft.com/purview/glossary-insights",
+ "service": "Purview",
"services": [
- "Storage",
"WAF"
],
- "severity": "Medium",
- "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Leverage Insights for Glossary, Classifications, Sensitivity Labels",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.RecoveryServices/vaults",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f",
- "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
- "service": "Site Recovery",
+ "guid": "b130a888-9579-4e76-a896-e710a7da7be9",
+ "link": "https://learn.microsoft.com/purview/compliance-manager",
+ "service": "Purview",
"services": [
- "ASR",
"WAF"
],
"severity": "Medium",
- "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it",
- "waf": "Cost"
+ "text": "Generate assessment scores",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Storage/storageAccounts",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1",
- "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
- "service": "Storage",
+ "guid": "956d14d3-c49d-4997-ab3d-1325aa225c6f",
+ "link": "https://learn.microsoft.com/purview/compliance-manager-scoring",
+ "service": "Purview",
"services": [
- "Storage",
"WAF"
],
"severity": "Medium",
- "text": "Storage accounts: check hot tier and/or GRS necessary",
- "waf": "Cost"
+ "text": "Profiling- get summaries of data content",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18",
- "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
- "service": "VM",
+ "guid": "4e0685ed-ddea-48a4-a7cd-eb3c61fc2fc1",
+ "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts",
+ "service": "Purview",
"services": [
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Disks - validate use of Premium SSD disks everywhere: for example, non-prod could swap to Standard SSD or on-demand Premium SSD ",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Follow Microsoft Purview Data Owner access policies",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5",
- "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview",
- "service": "Synapse",
+ "guid": "4eea6e69-d8d9-4a3e-bc21-8e687ab067ac",
+ "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy",
+ "service": "Purview",
"services": [
- "EventHubs",
- "Monitor",
- "Cost",
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Follow Self-service access policies",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
+ "arm-service": "Microsoft.Purview/accounts",
"checklist": "WAF checklist",
- "guid": "35e33789-7e31-4c67-b68c-f6a62a119495",
- "link": "https://learn.microsoft.com/azure/virtual-machines/availability",
- "service": "Synapse",
+ "guid": "b49e5b96-0332-44ec-b8cc-13318da61170",
+ "link": "https://learn.microsoft.com/purview/concept-policies-devops",
+ "service": "Purview",
"services": [
- "Storage",
- "Cost",
- "WAF"
+ "WAF",
+ "AzurePolicy"
],
- "severity": "Medium",
- "text": "Export cost data to a storage account for additional data analysis.",
- "waf": "Cost"
+ "severity": "Low",
+ "text": "Follow DevOps policies",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
+ "arm-service": "Microsoft.Devices/deviceUpdateServices",
"checklist": "WAF checklist",
- "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "Synapse",
+ "guid": "0e03f5ee-4648-423c-bb86-7239480f9171",
+ "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
+ "service": "Device Update for IoT Hub",
"services": [
- "SQL",
- "Cost",
"WAF"
],
- "severity": "Medium",
- "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.",
- "waf": "Cost"
+ "severity": "High",
+ "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled).",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
+ "arm-service": "Microsoft.Devices/deviceUpdateServices",
"checklist": "WAF checklist",
- "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4",
- "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview",
- "service": "Synapse",
+ "guid": "c0c273bd-00ad-419a-9f2f-fc72fb181e55",
+ "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability",
+ "service": "Device Update for IoT Hub",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Enable the serverless Apache Spark automatic pause feature and set your timeout value accordingly.",
- "waf": "Cost"
+ "severity": "High",
+ "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the DPS instances from an affected region to the corresponding geo-paired region.",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
+ "arm-service": "Microsoft.Devices/deviceUpdateServices",
"checklist": "WAF checklist",
- "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e",
- "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
- "service": "Synapse",
+ "guid": "3af8abe6-07eb-4287-b393-6c4abe3702eb",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "Device Update for IoT Hub",
"services": [
"WAF"
],
- "severity": "Medium",
- "text": "Create multiple Apache Spark pool definitions of various sizes.",
- "waf": "Cost"
+ "severity": "High",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Synapse/workspaces",
+ "arm-service": "Microsoft.Devices/deviceUpdateServices",
"checklist": "WAF checklist",
- "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a",
- "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
- "service": "Synapse",
+ "guid": "bd91245c-fe32-4e98-a085-794a40f4bfe1",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "Device Update for IoT Hub",
"services": [
- "Cost",
- "WAF"
+ "WAF",
+ "AppSvc"
],
- "severity": "Medium",
- "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "severity": "High",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.Devices/provisioningServices",
"checklist": "WAF checklist",
- "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb",
- "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
- "service": "VM",
+ "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare",
+ "service": "IoT Hub DPS",
"services": [
- "VM",
- "Cost",
"WAF"
],
- "severity": "Medium",
- "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "severity": "High",
+ "text": "Select the right Logic App hosting plan based on your business & SLO requirements",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.Devices/provisioningServices",
"checklist": "WAF checklist",
- "guid": "544451e1-92d3-4442-a3c7-628637a551c5",
- "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview",
- "service": "VM",
+ "guid": "f6dd7977-1123-4f39-b488-f91415a8430a",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps",
+ "service": "IoT Hub DPS",
"services": [
- "VM",
"WAF"
],
- "severity": "Medium",
- "text": "Right-sizing all VMs",
- "waf": "Cost"
+ "severity": "High",
+ "text": "Protect logic apps from region failures with zone redundancy and availability zones",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.Devices/provisioningServices",
"checklist": "WAF checklist",
- "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2",
- "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet",
- "service": "VM",
+ "guid": "8aed4fbf-0830-4883-899d-222a154af478",
+ "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json",
+ "service": "IoT Hub DPS",
"services": [
- "VM",
"WAF"
],
- "severity": "Medium",
- "text": "Swap VM sized with normalized and most recent sizes",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "severity": "High",
+ "text": "Consider a Cross-Region DR strategy for critical workloads",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.Devices/provisioningServices",
"checklist": "WAF checklist",
- "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
+ "guid": "da0f033e-d180-4f36-9aa4-c468dba14203",
+ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro",
+ "service": "IoT Hub DPS",
"services": [
- "Monitor",
- "VM",
- "WAF"
+ "WAF",
+ "AppSvc"
],
- "severity": "Medium",
- "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%",
- "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
- "waf": "Cost"
+ "severity": "High",
+ "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
+ "waf": "Reliability"
},
{
- "arm-service": "Microsoft.Compute/virtualMachines",
+ "arm-service": "Microsoft.Devices/provisioningServices",
"checklist": "WAF checklist",
- "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a",
- "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
- "service": "VM",
+ "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1",
+ "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/",
+ "service": "IoT Hub DPS",
"services": [
- "VM",
"WAF"
],
"severity": "Medium",
- "text": "Containerizing an application can improve VM density and save money on scaling it",
- "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
- "waf": "Cost"
+ "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code",
+ "waf": "Operations"
},
{
"category": "Operations management",
@@ -35553,7 +39105,7 @@
],
"metadata": {
"name": "Master checklist",
- "timestamp": "August 08, 2024"
+ "timestamp": "August 12, 2024"
},
"severities": [
{
diff --git a/checklists/waf_checklist.en.json b/checklists/waf_checklist.en.json
index acb339bc5..c52f1b082 100644
--- a/checklists/waf_checklist.en.json
+++ b/checklists/waf_checklist.en.json
@@ -1,5 +1,1759 @@
{
"items": [
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "70c15989-c726-42c7-b0d3-24b7375b9201",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.",
+ "training": "https://learn.microsoft.com/training/modules/deploy-resources-scopes-bicep/2-understand-deployment-scopes",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation",
+ "service": "Entra",
+ "severity": "Low",
+ "text": "Use Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants.",
+ "training": "https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction/",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Use Azure Lighthouse for Multi-Tenant Management with the same IDs.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/concepts/cross-tenant-management-experience",
+ "waf": "Operations"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations",
+ "service": "Entra",
+ "severity": "High",
+ "text": "If you give a partner access to administer your tenant, use Azure Lighthouse.",
+ "training": "https://learn.microsoft.com/azure/lighthouse/how-to/onboard-customer",
+ "waf": "Cost"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "348ef254-c27d-442e-abba-c7571559ab91",
+ "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account",
+ "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
+ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.",
+ "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
+ "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Enforce Microsoft Entra ID Conditional Access policies for any user with rights to Azure environments.",
+ "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
+ "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Enforce multi-factor authentication for any user with rights to the Azure environments.",
+ "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
+ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
+ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "If planning to switch from Active Directory Domain Services to Entra domain services, evaluate the compatibility of all workloads.",
+ "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.",
+ "training": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs",
+ "waf": "Security"
+ },
+ {
+ "ammp": true,
+ "checklist": "Azure Landing Zone Review",
+ "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
+ "service": "Entra",
+ "severity": "High",
+ "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout.",
+ "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "35037e68-9349-4c15-b371-228514f4cdff",
+ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Do not use on-premises synced accounts for Microsoft Entra ID role assignments, unless you have a scenario that specifically requires it.",
+ "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
+ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "When using Microsoft Entra ID Application Proxy to give remote users access to applications, manage it as a Platform resource as you can only have one instance per tenant.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "Use a hub-and-spoke network topology for network scenarios that require maximum flexibility.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Deploy shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS services.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Cost"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Use a DDoS Network or IP protection plan for all public IP addresses in application landing zones.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
+ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
+ "service": "NVA",
+ "severity": "Medium",
+ "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
+ "service": "ExpressRoute",
+ "severity": "Low",
+ "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualHubs",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc",
+ "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1",
+ "service": "ARS",
+ "severity": "Low",
+ "text": "If using Route Server, use a /27 prefix for the Route Server subnet.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-route-server/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.",
+ "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant",
+ "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000).",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant",
+ "guid": "3d457936-e9b7-41eb-bdff-314b26450b12",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "Limit the number of routes per route table to 400.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
+ "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings.",
+ "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr",
+ "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
+ "severity": "Medium",
+ "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
+ "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16).",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
+ "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Do not use overlapping IP address ranges for production and disaster recovery sites.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal",
+ "service": "DNS",
+ "severity": "Medium",
+ "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
+ "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview",
+ "service": "DNS",
+ "severity": "Medium",
+ "text": "For environments where name resolution across Azure and on-premises is required and there is no existing enterprise DNS service like Active Directory, use Azure DNS Private Resolver to route DNS requests to Azure or to on-premises DNS servers.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
+ "service": "DNS",
+ "severity": "Low",
+ "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Network/dnsZones",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "614658d3-558f-4d77-849b-821112df27ee",
+ "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
+ "service": "DNS",
+ "severity": "High",
+ "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.",
+ "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-overview",
+ "service": "Bastion",
+ "severity": "Medium",
+ "text": "Use Azure Bastion to securely connect to your network.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.network/bastionHosts",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant",
+ "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0",
+ "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet",
+ "service": "Bastion",
+ "severity": "Medium",
+ "text": "Use Azure Bastion in a subnet /26 or larger.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-bastion/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
+ "service": "WAF",
+ "severity": "Medium",
+ "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
+ "severity": "Low",
+ "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
+ "service": "WAF",
+ "severity": "High",
+ "text": "When WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b034c01e-110b-463a-b36e-e3346e57f225",
+ "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Plan for how to manage your network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed.",
+ "training": "https://learn.microsoft.com/training/modules/configure-virtual-networks/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930",
+ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41",
+ "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp",
+ "service": "Policy",
+ "severity": "High",
+ "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines. Use exclusions if public IPs are needed on specific VMs.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-policy/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Use ExpressRoute as the primary connection to Azure. Use VPNs as a source of backup connectivity.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.",
+ "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "When you use multiple ExpressRoute circuits or multiple on-prem locations, use BGP attributes to optimize routing.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
+ "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant",
+ "guid": "7025b442-f6e9-4af6-b11f-c9574916016f",
+ "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id",
+ "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
+ "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
+ "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
+ "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
+ "service": "VPN",
+ "severity": "Medium",
+ "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/virtualNetworkGateways",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable",
+ "service": "VPN",
+ "severity": "Medium",
+ "text": "Use redundant VPN appliances on-premises (active/active or active/passive).",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "718cb437-b060-2589-8856-2e93a5c6633b",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Cost"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
+ "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)",
+ "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Use ExpressRoute circuits from different peering locations for redundancy.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Use site-to-site VPN as failover of ExpressRoute, if only using a single ExpressRoute circuit.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))",
+ "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d581a947-69a2-4783-942e-9df3664324c8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "669b215a-ce43-4371-8f6f-11047f6490f1",
+ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9",
+ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5234c93f-b651-41dd-80c1-234177b91ced",
+ "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Do not use ExpressRoute circuits for VNet-to-VNet communication.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Performance"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
+ "service": "N/A",
+ "severity": "Low",
+ "text": "Do not send Azure traffic to hybrid locations for inspection. Instead, follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network.",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
+ "link": "https://learn.microsoft.com/azure/firewall/overview",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it).",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner",
+ "service": "Firewall",
+ "severity": "Low",
+ "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant",
+ "guid": "14d99880-2f88-47e8-a134-62a7d85c94af",
+ "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant",
+ "guid": "c10d51ef-f999-455d-bba0-5c90ece07447",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Use Azure Firewall Premium to enable additional security features.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant",
+ "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant",
+ "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant",
+ "guid": "a3784907-9836-4271-aafc-93535f8ec08b",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "715d833d-4708-4527-90ac-1b142c7045ba",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy",
+ "service": "Firewall",
+ "severity": "Important",
+ "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant",
+ "guid": "22d6419e-b627-4d95-9e7d-019fa759387f",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Use a /26 prefix for your Azure Firewall subnets.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-firewall/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7",
+ "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use.",
+ "training": "https://learn.microsoft.com/training/modules/intro-to-azure-firewall-manager/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1",
+ "link": "https://learn.microsoft.com/azure/firewall/ip-groups",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Use IP Groups or IP prefixes to reduce number of IP table rules.",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a",
+ "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Do not use wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7371dc21-251a-47a3-af14-6e01b9da4757",
+ "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-to-azure-virtual-networks/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "346840b8-1064-496e-8396-4b1340172d52",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "If you are using Azure Firewall Premium, enable TLS Inspection.",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c",
+ "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories",
+ "service": "Firewall",
+ "severity": "Low",
+ "text": "Use web categories to allow or deny outbound access to specific topics.",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a",
+ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-application-gateway/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad",
+ "link": "https://learn.microsoft.com/azure/firewall/dns-details",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Enable Azure Firewall DNS proxy configuration.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da",
+ "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics",
+ "service": "Firewall",
+ "severity": "High",
+ "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs.",
+ "training": "https://learn.microsoft.com/training/courses/az-700t00/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "64e7000e-3c06-485e-b455-ced7f454cba3",
+ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall",
+ "service": "Firewall",
+ "severity": "Low",
+ "text": "Implement backups for your firewall rules",
+ "training": "https://learn.microsoft.com/training/courses/az-104t00/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/applicationGateways",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
+ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
+ "service": "App Gateway",
+ "severity": "High",
+ "text": "Do not disrupt control-plane communication for Azure PaaS services injected into a virtual networks, such as with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
+ "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview",
+ "service": "ExpressRoute",
+ "severity": "Medium",
+ "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/virtualNetworks",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
+ "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview",
+ "service": "VNet",
+ "severity": "High",
+ "text": "Don't enable virtual network service endpoints by default on all subnets.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/azureFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
+ "link": "azure/private-link/inspect-traffic-with-azure-firewall",
+ "service": "Firewall",
+ "severity": "Medium",
+ "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.network/expressRouteCircuits",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant",
+ "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917",
+ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway",
+ "service": "ExpressRoute",
+ "severity": "High",
+ "text": "Use at least a /27 prefix for your Gateway subnets.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
+ "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
+ "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
+ "service": "NSG",
+ "severity": "High",
+ "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
+ "service": "NSG",
+ "severity": "Medium",
+ "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
+ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "service": "NSG",
+ "severity": "Medium",
+ "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
+ "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview",
+ "service": "NSG",
+ "severity": "Medium",
+ "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.",
+ "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Network/networkSecurityGroups",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)",
+ "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41",
+ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
+ "service": "NSG",
+ "severity": "Medium",
+ "text": "Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules.",
+ "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Use Virtual WAN if your scenario is explicitly described in the list of Virtual WAN routing designs.",
+ "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Performance"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant",
+ "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/howto-firewall",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Ensure that your virtual WAN network architecture aligns to an identified architecture scenario.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "727c77e1-b9aa-4a37-a024-129d042422c1",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Do not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels",
+ "service": "VWAN",
+ "severity": "Medium",
+ "text": "Configure label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "microsoft.network/virtualWans",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "9c75dfef-573c-461c-a698-68598595581a",
+ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation",
+ "service": "VWAN",
+ "severity": "High",
+ "text": "Assign at least a /23 prefix to virtual hubs to ensure enough IP space is available.",
+ "training": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "High",
+ "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "High",
+ "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "43334f24-9116-4341-a2ba-527526944008",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
+ "service": "Policy",
+ "severity": "Low",
+ "text": "Use Azure Policy to control which services users can provision at the subscription/management group level.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "High",
+ "text": "Use built-in policies where possible to minimize operational overhead.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.",
+ "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "19048384-5c98-46cb-8913-156a12476e49",
+ "link": "https://learn.microsoft.com/azure/governance/policy/overview",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
+ "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "If any data sovereignty requirements exist, Azure Policies should be deployed to enforce them.",
+ "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "For Sovereign Landing Zone, deploy sovereignty policy baseline and assign at correct management group level.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "For Sovereign Landing Zone, document Sovereign Control objectives to policy mapping.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Authorization/policyDefinitions",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a",
+ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives",
+ "service": "Policy",
+ "severity": "Medium",
+ "text": "For Sovereign Landing Zone, ensure process is in place for management of 'Sovereign Control objectives to policy mapping'.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.",
+ "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work",
+ "service": "Monitor",
+ "severity": "High",
+ "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.",
+ "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
+ "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.",
+ "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.",
+ "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/networkWatchers",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "90483845-c986-4cb2-a131-56a12476e49f",
+ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
+ "service": "Network Watcher",
+ "severity": "Medium",
+ "text": "Use Network Watcher to proactively monitor traffic flows.",
+ "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "Use Azure Monitor Logs for insights and reporting.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-monitor/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "Use Azure Monitor alerts for the generation of operational alerts.",
+ "training": "https://learn.microsoft.com/training/modules/incident-response-with-alerting-on-azure/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
+ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.",
+ "training": "https://learn.microsoft.com/training/modules/explore-azure-automation-devops/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Backup",
+ "severity": "Low",
+ "text": "When using Azure Backup, use the correct backup types (GRS, ZRS & LRS) for your backup, as the default setting is GRS.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "Reliability"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
+ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Use Azure guest policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "description": "Use Azure Policy's guest configuration features to audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.",
+ "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Monitor VM security configuration drift via Azure Policy.",
+ "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
+ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.",
+ "training": "https://learn.microsoft.com/training/modules/protect-infrastructure-with-site-recovery/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.RecoveryServices/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
+ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
+ "service": "Backup",
+ "severity": "Medium",
+ "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.",
+ "training": "https://learn.microsoft.com/training/modules/design-solution-for-backup-disaster-recovery/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
+ "service": "WAF",
+ "severity": "High",
+ "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.",
+ "training": "https://learn.microsoft.com/training/modules/capture-application-logs-app-service/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "microsoft.network/frontdoorwebApplicationFirewalls",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
+ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
+ "service": "WAF",
+ "severity": "Medium",
+ "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.",
+ "training": "https://learn.microsoft.com/training/paths/sc-200-connect-logs-to-azure-sentinel/",
+ "waf": "Operations"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "5017f154-e3ab-4369-9829-e7e316183687",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
+ "service": "Key Vault",
+ "severity": "High",
+ "text": "Use Azure Key Vault to store your secrets and credentials.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
+ "guid": "a0477a20-9945-4bda-9333-4f2491163418",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "913156a1-2476-4e49-b541-acdce979377b",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Establish an automated process for key and certificate rotation.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.",
+ "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.",
+ "training": "https://learn.microsoft.com/training/modules/configure-azure-key-vault-networking-settings/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "Use an Azure Key Vault per application per environment per region.",
+ "training": "https://learn.microsoft.com/training/modules/implement-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
+ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb",
+ "link": "https://learn.microsoft.com/industry/sovereignty/key-management",
+ "service": "Key Vault",
+ "severity": "Medium",
+ "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.",
+ "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
+ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.",
+ "training": "https://learn.microsoft.com/training/modules/monitor-report-aad-security-events/",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "09945bda-4333-44f2-9911-634182ba5275",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management",
+ "service": "Defender",
+ "severity": "High",
+ "text": "Enable Defender Cloud Security Posture Management for all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/microsoft-defender-cloud-security-posture/",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
+ "service": "Defender",
+ "severity": "High",
+ "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a",
+ "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription",
+ "service": "Defender",
+ "severity": "High",
+ "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.",
+ "training": "https://learn.microsoft.com/training/modules/understand-azure-defender-cloud-workload-protection/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b",
+ "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection",
+ "service": "VM",
+ "severity": "High",
+ "text": "Enable Endpoint Protection on IaaS Servers.",
+ "training": "https://learn.microsoft.com/training/modules/design-solutions-securing-server-client-endpoints/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Compute/virtualMachines",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
+ "link": "https://learn.microsoft.com/azure/security-center/",
+ "service": "VM",
+ "severity": "Medium",
+ "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.",
+ "training": "https://learn.microsoft.com/training/modules/create-log-analytics-workspace-microsoft-defender-cloud/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Insights/components",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
+ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
+ "service": "Monitor",
+ "severity": "Medium",
+ "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.",
+ "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba",
+ "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "For Sovereign Landing Zone, enable transparancy logs on the Entra ID tenant.",
+ "waf": "Security"
+ },
+ {
+ "checklist": "Azure Landing Zone Review",
+ "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc",
+ "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
+ "service": "Entra",
+ "severity": "Medium",
+ "text": "For Sovereign Landing Zone, enable customer Lockbox on the Entra ID tenant.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Storage",
+ "severity": "High",
+ "text": "Enable secure transfer to storage accounts.",
+ "training": "https://learn.microsoft.com/training/modules/secure-azure-storage-account/",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
+ "service": "Storage",
+ "severity": "High",
+ "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.KeyVault/vaults",
+ "checklist": "Azure Landing Zone Review",
+ "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e",
+ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds",
+ "service": "Key Vault",
+ "severity": "High",
+ "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.",
+ "training": "https://learn.microsoft.com/en-us/training/modules/implement-azure-key-vault/",
+ "waf": "Operations"
+ },
{
"arm-service": "Microsoft.ApiManagement/service",
"checklist": "Azure API Management Review",
@@ -2476,12 +4230,24 @@
{
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Storage Review Checklist",
- "description": "AAD tokens should be favored over shared access signatures, wherever possible",
+ "description": ". Enforcing the latest TLS version will reject request from clients using the older version. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "High",
+ "text": "Enforce the latest TLS version for a storage account",
+ "waf": "Security"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Microsoft Entra ID tokens should be favored over shared access signatures, wherever possible",
"guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
"link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
"service": "Azure Storage",
"severity": "High",
- "text": "Use Azure Active Directory (Azure AD) tokens for blob access",
+ "text": "Use Microsoft Entra ID tokens for blob access",
"waf": "Security"
},
{
@@ -2508,12 +4274,13 @@
{
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Storage Review Checklist",
- "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on AAD authentication makes it easier to tie storage access to a user. ",
+ "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on Entra ID authentication makes it easier to tie storage access to a user. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
"guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
"link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
"service": "Azure Storage",
"severity": "High",
- "text": "Consider disabling storage account keys, so that only AAD access (and user delegation SAS) is supported.",
+ "text": "Consider disabling storage account keys, so that only Microsoft Entra ID access (and user delegation SAS) is supported.",
"waf": "Security"
},
{
@@ -2691,11 +4458,12 @@
"arm-service": "Microsoft.Storage/storageAccounts",
"checklist": "Azure Storage Review Checklist",
"description": "Leverage Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) to find storage accounts which allow anonymous blob access.",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
"guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
"link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
"service": "Azure Storage",
"severity": "High",
- "text": "Consider whether public blob access is needed, or whether it can be disabled for certain storage accounts. ",
+ "text": "Consider whether public blob anonymous access is needed, or whether it can be disabled for certain storage accounts. ",
"waf": "Security"
},
{
@@ -8715,7 +10483,7 @@
],
"metadata": {
"name": "WAF checklist",
- "timestamp": "August 08, 2024"
+ "timestamp": "August 12, 2024"
},
"severities": [
{
diff --git a/checklists/waf_checklist.es.json b/checklists/waf_checklist.es.json
index 2e5c33a23..2bb0760dc 100644
--- a/checklists/waf_checklist.es.json
+++ b/checklists/waf_checklist.es.json
@@ -2554,6 +2554,438 @@
"text": "Utilizar plataformas, lenguajes, protocolos y marcos actualizados",
"waf": "Seguridad"
},
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Aplicación de las instrucciones del banco de pruebas de seguridad en la nube de Microsoft relacionadas con el almacenamiento",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Tenga en cuenta la \"Línea base de seguridad de Azure para el almacenamiento\"",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "De forma predeterminada, Azure Storage tiene una dirección IP pública y es accesible desde Internet. Los puntos de conexión privados permiten exponer de forma segura Azure Storage solo a los recursos de Azure Compute que necesitan acceso, lo que elimina la exposición a la Internet pública",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere la posibilidad de usar puntos de conexión privados para Azure Storage",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Las cuentas de almacenamiento recién creadas se crean mediante el modelo de implementación de ARM, de modo que RBAC, etcétera de auditoría, estén habilitados. Asegúrese de que no haya cuentas de almacenamiento antiguas con el modelo de implementación clásico en una suscripción",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Asegúrese de que las cuentas de almacenamiento más antiguas no usen el \"modelo de implementación clásica\"",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Aproveche Microsoft Defender para obtener información sobre actividades sospechosas y configuraciones incorrectas.",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Habilitación de Microsoft Defender para todas las cuentas de almacenamiento",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "El mecanismo de eliminación temporal permite recuperar blobs eliminados accidentalmente.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Habilitación de la \"eliminación temporal\" para blobs",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Considere la posibilidad de deshabilitar selectivamente la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe asegurarse de que la información eliminada se elimine inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Deshabilitación de la \"eliminación temporal\" para blobs",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "La eliminación temporal de contenedores permite recuperar un contenedor después de que se haya eliminado, por ejemplo, recuperarse de una operación de eliminación accidental.",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Habilitación de la \"eliminación temporal\" para contenedores",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Considere la posibilidad de deshabilitar selectivamente la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe asegurarse de que la información eliminada se elimine inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Deshabilitar la \"eliminación temporal\" para contenedores",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Evita la eliminación accidental de una cuenta de almacenamiento, obligando al usuario a quitar primero el bloqueo de eliminación, antes de la eliminación",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Habilitación de bloqueos de recursos en cuentas de almacenamiento",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Considere la posibilidad de aplicar directivas de \"retención legal\" o \"retención basada en tiempo\" para los blobs, de modo que sea imposible eliminar el blob, el contenedor o la cuenta de almacenamiento. Tenga en cuenta que 'imposible' en realidad significa 'imposible'; una vez que una cuenta de almacenamiento contiene un blob inmutable, la única manera de \"deshacerse\" de esa cuenta de almacenamiento es cancelando la suscripción de Azure.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere la posibilidad de blobs inmutables",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Considere la posibilidad de deshabilitar el acceso HTTP/80 no protegido a la cuenta de almacenamiento, de modo que todas las transferencias de datos estén cifradas, protegidas contra la integridad y el servidor esté autenticado. ",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Requerir HTTPS, es decir, deshabilitar el puerto 80 en la cuenta de almacenamiento",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Al configurar un dominio personalizado (nombre de host) en una cuenta de almacenamiento, compruebe si necesita TLS/HTTPS; si es así, es posible que tenga que colocar Azure CDN delante de la cuenta de almacenamiento.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Al aplicar HTTPS (deshabilitar HTTP), compruebe que no usa dominios personalizados (CNAME) para la cuenta de almacenamiento.",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Requerir HTTPS cuando un cliente usa un token de SAS para acceder a los datos de blob ayuda a minimizar el riesgo de pérdida de credenciales.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Limitar los tokens de firma de acceso compartido (SAS) solo a las conexiones HTTPS",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": ". Al aplicar la versión más reciente de TLS, se rechazarán las solicitudes de los clientes que utilicen la versión anterior. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Aplicación de la versión más reciente de TLS para una cuenta de almacenamiento",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Los tokens de identificador de Microsoft Entra deben favorecerse sobre las firmas de acceso compartido, siempre que sea posible",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Uso de tokens de identificador de Microsoft Entra para el acceso a blobs",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Al asignar un rol a un usuario, grupo o aplicación, conceda a esa entidad de seguridad solo los permisos necesarios para que pueda realizar sus tareas. Limitar el acceso a los recursos ayuda a evitar el uso indebido no intencionado y malintencionado de los datos.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Privilegio mínimo en los permisos de IaM",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Una SAS de delegación de usuarios está protegida con credenciales de Azure Active Directory (Azure AD) y también con los permisos especificados para la SAS. Una SAS de delegación de usuarios es análoga a una SAS de servicio en cuanto a su ámbito y función, pero ofrece ventajas de seguridad con respecto a la SAS de servicio. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Al usar SAS, prefiera \"SAS de delegación de usuarios\" en lugar de SAS basada en clave de cuenta de almacenamiento.",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Las claves de la cuenta de almacenamiento ('claves compartidas') tienen muy pocas capacidades de auditoría. Si bien se puede monitorear quién o cuándo obtuvo una copia de las claves, una vez que las claves están en manos de varias personas, es imposible atribuir el uso a un usuario específico. Confiar únicamente en la autenticación de ID de Entra facilita la vinculación del acceso al almacenamiento de un usuario. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere la posibilidad de deshabilitar las claves de la cuenta de almacenamiento, de modo que solo se admita el acceso a Microsoft Entra ID (y SAS de delegación de usuarios).",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Utilice los datos del registro de actividad para identificar \"cuándo\", \"quién\", \"qué\" y \"cómo\" se está viendo o cambiando la seguridad de la cuenta de almacenamiento (es decir, claves de cuenta de almacenamiento, directivas de acceso, etcétera).",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere la posibilidad de usar Azure Monitor para auditar las operaciones del plano de control en la cuenta de almacenamiento",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Una política de caducidad de claves le permite establecer un recordatorio para la rotación de las claves de acceso de la cuenta. El recordatorio se muestra si ha transcurrido el intervalo especificado y las teclas aún no se han girado.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Al usar claves de cuenta de almacenamiento, considere la posibilidad de habilitar una \"directiva de expiración de claves\"",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Una directiva de expiración de SAS especifica un intervalo recomendado durante el cual la SAS es válida. Las directivas de caducidad de SAS se aplican a una SAS de servicio o a una SAS de cuenta. Cuando un usuario genera una SAS de servicio o una SAS de cuenta con un intervalo de validez mayor que el intervalo recomendado, verá una advertencia.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Considere la posibilidad de configurar una directiva de expiración de SAS",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Las directivas de acceso almacenadas ofrecen la opción de revocar los permisos de una SAS de servicio sin tener que volver a generar las claves de la cuenta de almacenamiento. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Considere la posibilidad de vincular SAS a una directiva de acceso almacenada",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Considere la posibilidad de configurar el repositorio de código fuente de la aplicación para detectar cadenas de conexión protegidas y claves de cuenta de almacenamiento.",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Lo ideal es que la aplicación use una identidad administrada para autenticarse en Azure Storage. Si eso no es posible, considere la posibilidad de tener la credencial de almacenamiento (cadena de conexión, clave de cuenta de almacenamiento, SAS, credencial de entidad de servicio) en Azure KeyVault o un servicio equivalente.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere la posibilidad de almacenar cadenas de conexión en Azure KeyVault (en escenarios en los que las identidades administradas no son posibles)",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Utilice los tiempos de caducidad a corto plazo en una SAS de servicio SAS ad hoc o en una SAS de cuenta. De esta manera, incluso si una SAS se ve comprometida, solo es válida durante un corto período de tiempo. Esta práctica es especialmente importante si no puede hacer referencia a una política de acceso almacenada. Los tiempos de expiración a corto plazo también limitan la cantidad de datos que se pueden escribir en un blob al limitar el tiempo disponible para cargarlos en él.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Esfuércese por períodos de validez cortos para SAS ad-hoc",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Al crear una SAS, sea lo más específico y restrictivo posible. Prefiera una SAS para un solo recurso y operación en lugar de una SAS que proporciona un acceso mucho más amplio.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Aplicación de un ámbito limitado a una SAS",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Una SAS puede incluir parámetros sobre las direcciones IP de cliente o los intervalos de direcciones que están autorizados a solicitar un recurso mediante la SAS. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Considere la posibilidad de definir el ámbito de SAS a una dirección IP de cliente específica, siempre que sea posible",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Una SAS no puede restringir la cantidad de datos que carga un cliente; Dado el modelo de precios de la cantidad de almacenamiento a lo largo del tiempo, podría tener sentido validar si los clientes cargaron contenidos malintencionados de gran tamaño.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
+ "severity": "Bajo",
+ "text": "Considere la posibilidad de comprobar los datos cargados, después de que los clientes hayan utilizado una SAS para cargar un archivo. ",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Al acceder al almacenamiento de blobs a través de SFTP mediante una \"cuenta de usuario local\", no se aplican los controles RBAC \"habituales\". El acceso a blobs a través de NFS o REST puede ser más restrictivo que el acceso SFTP. Desafortunadamente, a partir de principios de 2023, los usuarios locales son la única forma de administración de identidades que actualmente es compatible con el punto de conexión SFTP",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "SFTP: Limite la cantidad de \"usuarios locales\" para el acceso SFTP y audite si el acceso es necesario a lo largo del tiempo.",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "SFTP: El punto de conexión SFTP no admite ACL similares a POSIX.",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "El almacenamiento es compatible con CORS (Cross-Origin Resource Sharing), es decir, una función HTTP que permite a las aplicaciones web de un dominio diferente aflojar la política del mismo origen. Al habilitar CORS, mantenga CorsRules con el mínimo privilegio.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Evite las políticas de CORS demasiado amplias",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Los datos en reposo siempre se cifran en el lado del servidor y, además, también pueden estar cifrados en el lado del cliente. El cifrado del lado del servidor puede producirse mediante una clave administrada por la plataforma (valor predeterminado) o una clave administrada por el cliente. El cifrado del lado cliente puede producirse haciendo que el cliente proporcione una clave de cifrado y descifrado por blob al almacenamiento de Azure o controlando completamente el cifrado en el lado cliente. por lo tanto, no depende en absoluto de Azure Storage para obtener garantías de confidencialidad.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Determine cómo se deben cifrar los datos en reposo. Comprender el modelo de subprocesos para los datos.",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Determine cuál o si se debe utilizar el cifrado de la plataforma.",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Determine qué cifrado del lado del cliente se debe usar, si se debe usar.",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Aproveche el Explorador de Resource Graph (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) para buscar cuentas de almacenamiento que permitan el acceso anónimo a blobs.",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere si es necesario el acceso anónimo de blob público o si se puede deshabilitar para determinadas cuentas de almacenamiento. ",
+ "waf": "Seguridad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Aproveche un tipo de cuenta storagev2 para mejorar el rendimiento y la confiabilidad",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Aproveche el almacenamiento GRS, ZRS o GZRS para obtener la máxima disponibilidad",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Para la operación de escritura después de la conmutación por error, use la conmutación por error administrada por el cliente ",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Descripción de los detalles de la conmutación por error administrada por Microsoft",
+ "waf": "Fiabilidad"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "Medio",
+ "text": "Habilitar eliminación temporal",
+ "waf": "Fiabilidad"
+ },
{
"arm-service": "Microsoft.CognitiveServices/accounts",
"checklist": "Azure OpenAI Review",
@@ -8990,7 +9422,7 @@
],
"metadata": {
"name": "WAF checklist",
- "timestamp": "August 08, 2024"
+ "timestamp": "August 12, 2024"
},
"severities": [
{
diff --git a/checklists/waf_checklist.ja.json b/checklists/waf_checklist.ja.json
index 000155a97..20025db74 100644
--- a/checklists/waf_checklist.ja.json
+++ b/checklists/waf_checklist.ja.json
@@ -8078,6 +8078,438 @@
"text": "Azure DevOps または GitHub を活用して CI/CD を合理化し、ロジック アプリ コードを保護",
"waf": "オペレーションズ"
},
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "ストレージに関連する Microsoft クラウド セキュリティ ベンチマークのガイダンスを適用する",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "「ストレージの Azure セキュリティ ベースライン」を検討する",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Azure Storage は、既定ではパブリック IP アドレスを持ち、インターネットからアクセスできます。プライベート エンドポイントを使用すると、アクセスが必要な Azure コンピューティング リソースのみに Azure Storage を安全に公開できるため、パブリック インターネットへの露出がなくなります",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "Azure Storage のプライベート エンドポイントの使用を検討する",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "新しく作成されたストレージ アカウントは ARM デプロイ モデルを使用して作成されるため、RBAC、監査などがすべて有効になります。サブスクリプションにクラシック デプロイ モデルの古いストレージ アカウントがないことを確認します",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "古いストレージ アカウントが \"クラシック デプロイ モデル\" を使用していないことを確認する",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Microsoft Defender を活用して、不審なアクティビティや構成ミスについて学習します。",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "すべてのストレージ アカウントで Microsoft Defender を有効にする",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "論理的な削除メカニズムにより、誤って削除されたブロブを回復できます。",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "BLOB の '論理的な削除' を有効にする",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "たとえば、機密性、プライバシー、コンプライアンス上の理由など、削除された情報をすぐに削除するようにアプリケーションで確認する必要がある場合など、特定の BLOB コンテナに対して「論理的な削除」を選択的に無効にすることを検討してください。",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "BLOB の '論理的な削除' を無効にする",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "コンテナの論理的な削除を使用すると、コンテナが削除された後に、たとえば、誤って削除した操作から回復するなどして、コンテナを回復できます。",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "コンテナの「論理的な削除」を有効にする",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "たとえば、機密性、プライバシー、コンプライアンス上の理由など、削除された情報をすぐに削除するようにアプリケーションで確認する必要がある場合など、特定の BLOB コンテナに対して「論理的な削除」を選択的に無効にすることを検討してください。",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "コンテナの「論理的な削除」を無効にする",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "削除する前に、ユーザーに削除ロックを最初に解除するように強制することで、ストレージ アカウントが誤って削除されるのを防ぎます",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "ストレージ アカウントでのリソース ロックの有効化",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "BLOB の \"訴訟ホールド\" または \"時間ベースの保持\" ポリシーを検討して、BLOB、コンテナー、またはストレージ アカウントを削除できないようにします。「不可能」は実際には「不可能」を意味することに注意してください。ストレージ アカウントに不変 BLOB が含まれている場合、そのストレージ アカウントを \"削除\" する唯一の方法は、Azure サブスクリプションをキャンセルすることです。",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "不変ブロブについて考える",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "ストレージ アカウントへの保護されていない HTTP/80 アクセスを無効にして、すべてのデータ転送が暗号化され、整合性が保護され、サーバーが認証されるようにすることを検討してください。",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "HTTPS を要求する (つまり、ストレージ アカウントのポート 80 を無効にする)",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "ストレージ アカウントでカスタム ドメイン (ホスト名) を構成する場合は、TLS/HTTPS が必要かどうかを確認します。その場合は、ストレージ アカウントの前に Azure CDN を配置する必要がある場合があります。",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "HTTPS を適用する (HTTP を無効にする) 場合は、ストレージ アカウントにカスタム ドメイン (CNAME) を使用していないことを確認します。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "クライアントが SAS トークンを使用して BLOB データにアクセスするときに HTTPS を要求すると、資格情報の損失リスクを最小限に抑えるのに役立ちます。",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "Shared Access Signature (SAS) トークンを HTTPS 接続のみに制限する",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": ".最新の TLS バージョンを適用すると、古いバージョンを使用しているクライアントからの要求が拒否されます。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "ストレージ アカウントに最新の TLS バージョンを適用する",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Microsoft Entra ID トークンは、可能な限り、共有アクセス署名よりも優先する必要があります",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "BLOB アクセスに Microsoft Entra ID トークンを使用する",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "ユーザー、グループ、またはアプリケーションにロールを割り当てる場合は、タスクの実行に必要なアクセス許可のみをそのセキュリティ プリンシパルに付与します。リソースへのアクセスを制限することで、意図しないデータの誤用と悪意のある誤用の両方を防ぐことができます。",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "IaM アクセス許可の最小特権",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "ユーザー委任 SAS は、Azure Active Directory (Azure AD) 資格情報と、SAS に指定されたアクセス許可によって保護されます。ユーザー委任 SAS は、そのスコープと機能の点でサービス SAS に似ていますが、サービス SAS よりもセキュリティ上の利点があります。",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "SAS を使用する場合は、ストレージ アカウント キー ベースの SAS よりも \"ユーザー委任 SAS\" を優先します。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "ストレージ アカウント キー (\"共有キー\") には、監査機能がほとんどありません。誰が/いつキーのコピーをフェッチしたかを監視することはできますが、キーが複数の人の手に渡ると、特定のユーザーに使用状況を帰属させることはできなくなります。Entra ID認証のみに依存すると、ストレージアクセスをユーザーに結び付けることが容易になります。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "Microsoft Entra ID アクセス (およびユーザー委任 SAS) のみがサポートされるように、ストレージ アカウント キーを無効にすることを検討してください。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "アクティビティ ログ データを使用して、ストレージ アカウントのセキュリティが (ストレージ アカウント キー、アクセス ポリシーなど) 表示または変更されているのは「いつ」、「誰が」、「何を」、「どのように」特定します。",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "Azure Monitor を使用して、ストレージ アカウントでのコントロール プレーン操作を監査することを検討してください",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "キーの有効期限ポリシーを使用すると、アカウント アクセス キーのローテーションのリマインダーを設定できます。リマインダーは、指定した間隔が経過し、キーがまだローテーションされていない場合に表示されます。",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "ストレージ アカウント キーを使用する場合は、\"キーの有効期限ポリシー\" を有効にすることを検討してください",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS 有効期限ポリシーは、SAS が有効である推奨間隔を指定します。SAS 有効期限ポリシーは、サービス SAS またはアカウント SAS に適用されます。ユーザーが、推奨間隔よりも長い有効期間でサービス SAS またはアカウント SAS を生成すると、警告が表示されます。",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "SAS 有効期限ポリシーの構成を検討する",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "保存されているアクセス ポリシーでは、ストレージ アカウント キーを再生成しなくても、サービス SAS のアクセス許可を取り消すことができます。",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "SASを保存されたアクセスポリシーにリンクすることを検討する",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "チェックインされた接続文字列とストレージ アカウント キーを検出するように、アプリケーションのソース コード リポジトリを構成することを検討してください。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "理想的には、アプリケーションでマネージド ID を使用して Azure Storage に対する認証を行う必要があります。それが不可能な場合は、ストレージ資格情報 (接続文字列、ストレージ アカウント キー、SAS、サービス プリンシパル資格情報) を Azure KeyVault または同等のサービスに持つことを検討してください。",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "Azure KeyVault に接続文字列を格納することを検討してください (マネージド ID が不可能なシナリオの場合)",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "アドホック SAS サービス SAS またはアカウント SAS で短期的な有効期限を使用します。このように、SASが侵害された場合でも、SASは短時間しか有効ではありません。この方法は、保存されたアクセス ポリシーを参照できない場合に特に重要です。有効期限が近いと、BLOB にアップロードできる時間を制限することで、BLOB に書き込むことができるデータの量も制限されます。",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "アドホックSASの有効期間を短くするよう努める",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SASを作成するときは、できるだけ具体的で制限的にしてください。1 つのリソースと操作には、より広範なアクセスを提供する SAS よりも SAS を優先します。",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "SAS に狭いスコープを適用する",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS には、SAS を使用してリソースを要求する権限を与えられたクライアントの IP アドレスまたはアドレス範囲のパラメーターを含めることができます。",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "可能な限り、SAS のスコープを特定のクライアント IP アドレスに設定することを検討してください",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS は、クライアントがアップロードするデータの量を制限することはできません。時間の経過に伴うストレージ量の価格設定モデルを考えると、クライアントが悪意を持って大きなコンテンツをアップロードしたかどうかを検証することは理にかなっているかもしれません。",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
+ "severity": "低い",
+ "text": "クライアントが SAS を使用してファイルをアップロードした後、アップロードされたデータを確認することを検討してください。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "「ローカル ユーザー アカウント」を使用して SFTP 経由で BLOB ストレージにアクセスする場合、「通常の」RBAC コントロールは適用されません。NFS または REST 経由の BLOB アクセスは、SFTP アクセスよりも制限が厳しい場合があります。残念ながら、2023 年初頭の時点で、SFTP エンドポイントで現在サポートされている ID 管理の形式は、ローカル ユーザーのみです",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "SFTP: SFTP アクセスの「ローカル ユーザー」の数を制限し、アクセスが必要かどうかを経時的に監査します。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "SFTP: SFTP エンドポイントは POSIX のような ACL をサポートしていません。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "ストレージは、CORS(Cross-Origin Resource Sharing)、つまり、異なるドメインのWebアプリが同一生成元ポリシーを緩和できるようにするHTTP機能をサポートしています。CORS を有効にするときは、CorsRules を最小限の特権に保ちます。",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "過度に広範なCORSポリシーを避ける",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "保存データは常にサーバー側で暗号化され、さらにクライアント側でも暗号化される場合があります。サーバー側の暗号化は、プラットフォーム管理キー (デフォルト) またはカスタマー管理キーを使用して行われる場合があります。クライアント側の暗号化は、クライアントが BLOB ごとに暗号化/暗号化解除キーを Azure ストレージに提供するか、クライアント側で暗号化を完全に処理することによって行われます。したがって、機密性の保証については Azure Storage にまったく依存しません。",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "保存データの暗号化方法を決定します。データのスレッドモデルを理解する。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "プラットフォームの暗号化を使用するかどうかを決定します。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "クライアント側の暗号化を使用するかどうかを決定します。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Resource Graph エクスプローラー (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) を利用して、匿名 BLOB アクセスを許可するストレージ アカウントを見つけます。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "パブリック BLOB の匿名アクセスが必要かどうか、または特定のストレージ アカウントに対して無効にできるかどうかを検討します。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "storagev2 アカウントタイプを活用して、パフォーマンスと信頼性を向上させます",
+ "waf": "確実"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
+ "severity": "高い",
+ "text": "GRS、ZRS、またはGZRSストレージを活用して、最高の可用性を実現",
+ "waf": "確実"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "フェールオーバー後の書き込み操作には、顧客管理のフェールオーバーを使用します",
+ "waf": "確実"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "Microsoft マネージド フェールオーバーの詳細を理解する",
+ "waf": "確実"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "中程度",
+ "text": "ソフト削除を有効にする",
+ "waf": "確実"
+ },
{
"arm-service": "microsoft.network/frontdoors",
"checklist": "Azure Application Delivery Networking",
@@ -8990,7 +9422,7 @@
],
"metadata": {
"name": "WAF checklist",
- "timestamp": "August 08, 2024"
+ "timestamp": "August 12, 2024"
},
"severities": [
{
diff --git a/checklists/waf_checklist.ko.json b/checklists/waf_checklist.ko.json
index 83be3434f..7f2dce610 100644
--- a/checklists/waf_checklist.ko.json
+++ b/checklists/waf_checklist.ko.json
@@ -3863,6 +3863,438 @@
"text": "Azure Cognitive Search 인덱스를 백업 및 복원합니다. 이 샘플 코드를 사용하여 인덱스 정의 및 스냅샷을 일련의 Json 파일에 백업합니다",
"waf": "신뢰도"
},
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "스토리지와 관련된 Microsoft 클라우드 보안 벤치마크의 지침 적용",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "'스토리지에 대한 Azure 보안 기준'을 고려합니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Azure Storage는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트를 사용하면 액세스가 필요한 Azure Compute 리소스에만 Azure Storage를 안전하게 노출할 수 있으므로 공용 인터넷에 노출되지 않습니다",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "Azure Storage에 프라이빗 엔드포인트를 사용하는 것이 좋습니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "새로 만든 스토리지 계정은 ARM 배포 모델을 사용하여 생성되므로 RBAC, 감사 등이 모두 활성화됩니다. 구독에 클래식 배포 모델을 사용하는 이전 저장소 계정이 없는지 확인합니다.",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "이전 스토리지 계정이 '클래식 배포 모델'을 사용하지 않는지 확인",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Microsoft Defender를 활용하여 의심스러운 활동 및 잘못된 구성에 대해 알아보세요.",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "모든 스토리지 계정에 대해 Microsoft Defender 사용",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "일시 삭제 메커니즘을 사용하면 실수로 삭제된 Blob을 복구할 수 있습니다.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "Blob에 대해 '일시 삭제' 사용Enable 'soft delete' for blobs",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "Blob에 대해 '일시 삭제' 사용 안 함",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "컨테이너에 대한 일시 삭제를 사용하면 컨테이너가 삭제된 후 복구할 수 있습니다(예: 실수로 삭제한 작업에서 복구).",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "컨테이너에 대해 '일시 삭제' 사용Enable 'soft delete' for containers",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "컨테이너에 대해 '일시 삭제' 사용 안 함",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "사용자가 삭제하기 전에 먼저 삭제 잠금을 제거하도록 강제하여 스토리지 계정의 우발적인 삭제를 방지합니다.",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "스토리지 계정에 대한 리소스 잠금 사용Enable resource locks on storage accounts",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Blob에 대한 '법적 보존' 또는 '시간 기반 보존' 정책을 고려하면 Blob, 컨테이너 또는 스토리지 계정을 삭제할 수 없습니다. '불가능한'은 실제로 '불가능한'을 의미합니다. 스토리지 계정에 변경할 수 없는 Blob이 포함되면 해당 스토리지 계정을 '제거'하는 유일한 방법은 Azure 구독을 취소하는 것입니다.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "변경할 수 없는 Blob 고려",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "스토리지 계정에 대한 보호되지 않는 HTTP/80 액세스를 사용하지 않도록 설정하여 모든 데이터 전송이 암호화되고 무결성이 보호되며 서버가 인증되도록 하는 것이 좋습니다. ",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "HTTPS 필요, 즉 스토리지 계정에서 포트 80 사용 안 함Require HTTPS, i.e. disable port 80 on the storage account",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "스토리지 계정에서 사용자 지정 도메인(호스트 이름)을 구성할 때 TLS/HTTPS가 필요한지 확인합니다. 이 경우 스토리지 계정 앞에 Azure CDN을 배치해야 할 수 있습니다.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "HTTPS를 적용(HTTP 사용 안 함)할 때 스토리지 계정에 사용자 지정 도메인(CNAME)을 사용하지 않는지 확인합니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "클라이언트가 SAS 토큰을 사용하여 Blob 데이터에 액세스할 때 HTTPS를 요구하면 자격 증명 손실 위험을 최소화하는 데 도움이 됩니다.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "SAS(공유 액세스 서명) 토큰을 HTTPS 연결로만 제한",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": ". 최신 TLS 버전을 적용하면 이전 버전을 사용하는 클라이언트의 요청이 거부됩니다. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "스토리지 계정에 대한 최신 TLS 버전 적용Enforce the latest TLS version for a storage account",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "가능한 경우 Microsoft Entra ID 토큰을 공유 액세스 서명보다 선호해야 합니다",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "Blob 액세스에 Microsoft Entra ID 토큰 사용Use Microsoft Entra ID tokens for blob access",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "사용자, 그룹 또는 응용 프로그램에 역할을 할당할 때 해당 보안 주체가 작업을 수행하는 데 필요한 권한만 부여합니다. 리소스에 대한 액세스를 제한하면 의도하지 않은 데이터 오용과 악의적인 데이터 오용을 모두 방지할 수 있습니다.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "IaM 권한의 최소 권한",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "사용자 위임 SAS는 Azure AD(Azure Active Directory) 자격 증명과 SAS에 대해 지정된 권한으로 보호됩니다. 사용자 위임 SAS는 범위와 기능 측면에서 서비스 SAS와 유사하지만 서비스 SAS에 비해 보안상의 이점을 제공합니다. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "SAS를 사용하는 경우 스토리지 계정 키 기반 SAS보다 '사용자 위임 SAS'를 선호합니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "스토리지 계정 키('공유 키')에는 감사 기능이 거의 없습니다. 누가/언제 키 복사본을 가져왔는지 모니터링할 수 있지만 키가 여러 사람의 손에 들어가면 특정 사용자의 사용을 귀속시킬 수 없습니다. Entra ID 인증에만 의존하면 스토리지 액세스를 사용자에게 더 쉽게 연결할 수 있습니다. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "Microsoft Entra ID 액세스(및 사용자 위임 SAS)만 지원되도록 스토리지 계정 키를 사용하지 않도록 설정하는 것이 좋습니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "활동 로그 데이터를 사용하여 스토리지 계정의 보안을 '언제', '누가', '무엇을' 및 '어떻게' 확인하거나 변경합니다(예: 스토리지 계정 키, 액세스 정책 등).",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "Azure Monitor를 사용하여 스토리지 계정에 대한 컨트롤 플레인 작업을 감사하는 것이 좋습니다",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "키 만료 정책을 사용하면 계정 액세스 키의 교체에 대한 미리 알림을 설정할 수 있습니다. 지정된 간격이 경과하고 키가 아직 회전되지 않은 경우 알림이 표시됩니다.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "스토리지 계정 키를 사용하는 경우 '키 만료 정책'을 사용하도록 설정하는 것이 좋습니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS 만료 정책은 SAS가 유효한 권장 간격을 지정합니다. SAS 만료 정책은 서비스 SAS 또는 계정 SAS에 적용됩니다. 사용자가 권장 간격보다 큰 유효성 간격으로 서비스 SAS 또는 계정 SAS를 생성하면 경고가 표시됩니다.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "SAS 만료 정책을 구성하는 것이 좋습니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "저장된 액세스 정책은 스토리지 계정 키를 다시 생성할 필요 없이 서비스 SAS에 대한 사용 권한을 취소할 수 있는 옵션을 제공합니다. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "SAS를 저장된 액세스 정책에 연결하는 것이 좋습니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "체크 인된 연결 문자열 및 저장소 계정 키를 검색하도록 응용 프로그램의 소스 코드 리포지토리를 구성하는 것이 좋습니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "이상적으로 애플리케이션은 관리 ID를 사용하여 Azure Storage에 인증해야 합니다. 가능하지 않은 경우 Azure KeyVault 또는 동등한 서비스에 스토리지 자격 증명(연결 문자열, 스토리지 계정 키, SAS, 서비스 주체 자격 증명)을 사용하는 것이 좋습니다.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "Azure KeyVault에 연결 문자열을 저장하는 것이 좋습니다(관리 ID를 사용할 수 없는 시나리오에서).",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "임시 SAS 서비스 SAS 또는 계정 SAS에서 가까운 만료 시간을 사용합니다. 이러한 방식으로 SAS가 손상되더라도 짧은 시간 동안만 유효합니다. 이 방법은 저장된 액세스 정책을 참조할 수 없는 경우에 특히 중요합니다. 또한 단기 만료 시간은 Blob에 업로드할 수 있는 시간을 제한하여 Blob에 쓸 수 있는 데이터의 양을 제한합니다.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "임시 SAS의 유효 기간을 단축하기 위해 노력",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS를 만들 때는 가능한 한 구체적이고 제한적이어야 합니다. 훨씬 더 광범위한 액세스를 제공하는 SAS보다 단일 리소스 및 작업에 대해 SAS를 선호합니다.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "SAS에 좁은 범위 적용",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS에는 SAS를 사용하여 리소스를 요청할 수 있는 권한이 있는 클라이언트 IP 주소 또는 주소 범위에 대한 매개 변수가 포함될 수 있습니다. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "가능한 경우 SAS 범위를 특정 클라이언트 IP 주소로 지정하는 것이 좋습니다",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS는 클라이언트가 업로드하는 데이터의 양을 제한할 수 없습니다. 시간 경과에 따른 스토리지 양의 가격 책정 모델을 감안할 때 클라이언트가 악의적으로 큰 콘텐츠를 업로드했는지 여부를 확인하는 것이 합리적일 수 있습니다.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
+ "severity": "낮다",
+ "text": "클라이언트가 SAS를 사용하여 파일을 업로드한 후 업로드된 데이터를 확인하는 것이 좋습니다. ",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "'로컬 사용자 계정'을 사용하여 SFTP를 통해 Blob Storage에 액세스하는 경우 '일반적인' RBAC 컨트롤이 적용되지 않습니다. NFS 또는 REST를 통한 Blob 액세스는 SFTP 액세스보다 더 제한적일 수 있습니다. 안타깝게도 2023년 초부터 로컬 사용자는 현재 SFTP 엔드포인트에 대해 지원되는 유일한 ID 관리 형태입니다",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "SFTP: SFTP 액세스를 위한 '로컬 사용자'의 수를 제한하고 시간이 지남에 따라 액세스가 필요한지 여부를 감사합니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "SFTP: SFTP 엔드포인트는 POSIX와 유사한 ACL을 지원하지 않습니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "스토리지는 CORS(Cross-Origin Resource Sharing), 즉 다른 도메인의 웹 앱이 동일 출처 정책을 완화할 수 있도록 하는 HTTP 기능을 지원합니다. CORS를 사용하도록 설정하는 경우 CorsRules를 최소 권한으로 유지합니다.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "지나치게 광범위한 CORS 정책 방지",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "미사용 데이터는 항상 서버 쪽에서 암호화되며 클라이언트 쪽에서도 암호화될 수 있습니다. 서버 쪽 암호화는 플랫폼 관리형 키(기본값) 또는 고객 관리형 키를 사용하여 발생할 수 있습니다. 클라이언트 쪽 암호화는 클라이언트가 Azure Storage에 Blob별로 암호화/암호 해독 키를 제공하도록 하거나 클라이언트 쪽에서 암호화를 완전히 처리하여 발생할 수 있습니다. 따라서 기밀 보장을 위해 Azure Storage에 전혀 의존하지 않습니다.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "미사용 데이터를 암호화하는 방법을 결정합니다. 데이터에 대한 스레드 모델을 이해합니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "어떤 플랫폼 암호화를 사용해야 하는지 확인합니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "클라이언트 쪽 암호화를 사용해야 하는지 여부를 결정합니다.",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "리소스 그래프 탐색기(리소스 | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true)를 활용하여 익명 Blob 액세스를 허용하는 스토리지 계정을 찾습니다.",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "공용 Blob 익명 액세스가 필요한지 또는 특정 스토리지 계정에 대해 사용하지 않도록 설정할 수 있는지 여부를 고려합니다. ",
+ "waf": "안전"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "성능 및 안정성 향상을 위해 storagev2 계정 유형 활용",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
+ "severity": "높다",
+ "text": "최고의 가용성을 위해 GRS, ZRS 또는 GZRS 스토리지 활용",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "장애 조치(failover) 후 쓰기 작업의 경우 고객 관리 장애 조치(failover)를 사용합니다. ",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "Microsoft 관리 장애 조치(failover) 세부 정보 이해",
+ "waf": "신뢰도"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "보통",
+ "text": "일시 삭제 사용",
+ "waf": "신뢰도"
+ },
{
"arm-service": "microsoft.cache/redis",
"checklist": "Redis Resiliency checklist",
@@ -8990,7 +9422,7 @@
],
"metadata": {
"name": "WAF checklist",
- "timestamp": "August 08, 2024"
+ "timestamp": "August 12, 2024"
},
"severities": [
{
diff --git a/checklists/waf_checklist.pt.json b/checklists/waf_checklist.pt.json
index 1e41cb251..f9bf55910 100644
--- a/checklists/waf_checklist.pt.json
+++ b/checklists/waf_checklist.pt.json
@@ -4783,6 +4783,438 @@
"text": "Faça com que as configurações de tolerância a desastres do site tenham sido devidamente consideradas e alteradas para sua empresa, se necessário.",
"waf": "Fiabilidade"
},
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Aplicar as diretrizes do parâmetro de comparação de segurança de nuvem da Microsoft relacionado ao armazenamento",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Considere a 'linha de base de segurança do Azure para armazenamento'",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Por padrão, o Armazenamento do Azure tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem expor com segurança o Armazenamento do Azure apenas aos recursos de Computação do Azure que precisam de acesso, eliminando assim a exposição à Internet pública",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere usar pontos de extremidade privados para o Armazenamento do Azure",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "As contas de armazenamento recém-criadas são criadas usando o modelo de implantação do ARM, para que o RBAC, a auditoria etc. estejam habilitados. Verifique se não há contas de armazenamento antigas com o modelo de implantação clássico em uma assinatura",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Verifique se as contas de armazenamento mais antigas não estão usando o \"modelo de implantação clássico\"",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Aproveite o Microsoft Defender para saber mais sobre atividades suspeitas e configurações incorretas.",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Habilitar o Microsoft Defender para todas as suas contas de armazenamento",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "O mecanismo de exclusão reversível permite recuperar blobs excluídos acidentalmente.",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Habilitar 'exclusão reversível' para blobs",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Considere desabilitar seletivamente a \"exclusão reversível\" para determinados contêineres de blob, por exemplo, se o aplicativo precisar garantir que as informações excluídas sejam excluídas imediatamente, por exemplo, por motivos de confidencialidade, privacidade ou conformidade. ",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Desabilitar a 'exclusão reversível' para blobs",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "A exclusão reversível para contêineres permite que você recupere um contêiner depois que ele foi excluído, por exemplo, recuperar de uma operação de exclusão acidental.",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Habilitar 'exclusão reversível' para contêineres",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Considere desabilitar seletivamente a \"exclusão reversível\" para determinados contêineres de blob, por exemplo, se o aplicativo precisar garantir que as informações excluídas sejam excluídas imediatamente, por exemplo, por motivos de confidencialidade, privacidade ou conformidade. ",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Desabilitar a 'exclusão reversível' para contêineres",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Impede a exclusão acidental de uma conta de armazenamento, forçando o usuário a remover primeiro o bloqueio de exclusão, antes da exclusão",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Habilitar bloqueios de recursos em contas de armazenamento",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Considere as políticas de 'retenção legal' ou 'retenção baseada em tempo' para blobs, de modo que seja impossível excluir o blob, o contêiner ou a conta de armazenamento. Observe que 'impossível' na verdade significa 'impossível'; depois que uma conta de armazenamento contém um blob imutável, a única maneira de \"se livrar\" dessa conta de armazenamento é cancelando a assinatura do Azure.",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere blobs imutáveis",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Considere desabilitar o acesso HTTP/80 desprotegido à conta de armazenamento, para que todas as transferências de dados sejam criptografadas, protegidas por integridade e o servidor seja autenticado. ",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Exigir HTTPS, ou seja, desabilitar a porta 80 na conta de armazenamento",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Ao configurar um domínio personalizado (nome do host) em uma conta de armazenamento, verifique se você precisa de TLS/HTTPS; nesse caso, talvez seja necessário colocar a CDN do Azure na frente de sua conta de armazenamento.",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Ao impor HTTPS (desabilitando o HTTP), verifique se você não usa domínios personalizados (CNAME) para a conta de armazenamento.",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Exigir HTTPS quando um cliente usa um token SAS para acessar dados de blob ajuda a minimizar o risco de perda de credenciais.",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Limitar tokens de assinatura de acesso compartilhado (SAS) apenas a conexões HTTPS",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": ". A imposição da versão mais recente do TLS rejeitará a solicitação de clientes que usam a versão mais antiga. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Impor a versão mais recente do TLS para uma conta de armazenamento",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Os tokens de ID do Microsoft Entra devem ser favorecidos em relação às assinaturas de acesso compartilhado, sempre que possível",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Usar tokens de ID do Microsoft Entra para acesso a blobs",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Ao atribuir uma função a um usuário, grupo ou aplicativo, conceda a essa entidade de segurança apenas as permissões necessárias para que ela execute suas tarefas. Limitar o acesso aos recursos ajuda a evitar o uso indevido não intencional e mal-intencionado de seus dados.",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Privilégios mínimos em permissões de IaM",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Uma SAS de delegação de usuário é protegida com credenciais do Azure Active Directory (Azure AD) e também pelas permissões especificadas para a SAS. Uma SAS de delegação de usuário é análoga a uma SAS de serviço em termos de escopo e função, mas oferece benefícios de segurança em relação à SAS de serviço. ",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Ao usar SAS, prefira 'SAS de delegação de usuário' em vez de SAS baseada em chave de conta de armazenamento.",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "As chaves da conta de armazenamento (\"chaves compartilhadas\") têm muito poucos recursos de auditoria. Embora possa ser monitorado em quem/quando buscou uma cópia das chaves, uma vez que as chaves estão nas mãos de várias pessoas, é impossível atribuir o uso a um usuário específico. Confiar apenas na autenticação do Entra ID facilita o acesso ao armazenamento a um usuário. ",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere desabilitar as chaves da conta de armazenamento, para que haja suporte apenas para o acesso à ID do Microsoft Entra (e à SAS de delegação de usuário).",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Use os dados do Log de Atividades para identificar \"quando\", \"quem\", \"o quê\" e \"como\" a segurança da sua conta de armazenamento está sendo exibida ou alterada (ou seja, chaves da conta de armazenamento, políticas de acesso etc.).",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere usar o Azure Monitor para auditar as operações do painel de controle na conta de armazenamento",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Uma política de expiração de chave permite que você defina um lembrete para a rotação das chaves de acesso da conta. O lembrete é exibido se o intervalo especificado tiver decorrido e as teclas ainda não tiverem sido giradas.",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Ao usar chaves de conta de armazenamento, considere habilitar uma 'política de expiração de chave'",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Uma política de expiração de SAS especifica um intervalo recomendado durante o qual a SAS é válida. As políticas de expiração de SAS se aplicam a uma SAS de serviço ou a uma SAS de conta. Quando um usuário gera SAS de serviço ou uma SAS de conta com um intervalo de validade maior que o intervalo recomendado, ele verá um aviso.",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Considere configurar uma política de expiração de SAS",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "As políticas de acesso armazenadas oferecem a opção de revogar permissões para uma SAS de serviço sem precisar regenerar as chaves da conta de armazenamento. ",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Considere vincular SAS a uma política de acesso armazenada",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Considere configurar o repositório de código-fonte do aplicativo para detectar cadeias de conexão e chaves de conta de armazenamento com check-in.",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Idealmente, seu aplicativo deve usar uma identidade gerenciada para autenticar no Armazenamento do Azure. Se isso não for possível, considere ter a credencial de armazenamento (cadeia de conexão, chave da conta de armazenamento, SAS, credencial da entidade de serviço) no Azure KeyVault ou em um serviço equivalente.",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere armazenar cadeias de conexão no Azure KeyVault (em cenários em que as identidades gerenciadas não são possíveis)",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Use tempos de expiração de curto prazo em uma SAS de serviço SAS ad hoc ou SAS de conta. Dessa forma, mesmo que uma SAS seja comprometida, ela é válida apenas por um curto período de tempo. Essa prática é especialmente importante se você não puder fazer referência a uma política de acesso armazenada. Os tempos de expiração de curto prazo também limitam a quantidade de dados que podem ser gravados em um blob, limitando o tempo disponível para carregar nele.",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Esforce-se por períodos de validade curtos para SAS ad-hoc",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Ao criar uma SAS, seja o mais específico e restritivo possível. Prefira uma SAS para um único recurso e operação em vez de uma SAS que oferece acesso muito mais amplo.",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Aplicar um escopo restrito a uma SAS",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Uma SAS pode incluir parâmetros nos quais os endereços IP do cliente ou intervalos de endereços estão autorizados a solicitar um recurso usando a SAS. ",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Considere definir o escopo da SAS para um endereço IP de cliente específico, sempre que possível",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Uma SAS não pode restringir a quantidade de dados que um cliente carrega; Dado o modelo de preços da quantidade de armazenamento ao longo do tempo, pode fazer sentido validar se os clientes carregaram conteúdos maliciosamente grandes.",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
+ "severity": "Baixo",
+ "text": "Considere verificar os dados carregados depois que os clientes usaram uma SAS para carregar um arquivo. ",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Ao acessar o armazenamento de blobs por meio do SFTP usando uma \"conta de usuário local\", os controles RBAC \"usuais\" não se aplicam. O acesso a blobs via NFS ou REST pode ser mais restritivo do que o acesso SFTP. Infelizmente, a partir do início de 2023, os usuários locais são a única forma de gerenciamento de identidade com suporte atual para o endpoint SFTP",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "SFTP: limite a quantidade de \"usuários locais\" para acesso SFTP e audite se o acesso é necessário ao longo do tempo.",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "SFTP: o endpoint SFTP não oferece suporte a ACLs semelhantes a POSIX.",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "O armazenamento oferece suporte ao CORS (Cross-Origin Resource Sharing), ou seja, um recurso HTTP que permite que aplicativos Web de um domínio diferente afrouxem a política de mesma origem. Ao habilitar o CORS, mantenha as CorsRules com o menor privilégio.",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Evite políticas de CORS excessivamente amplas",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Os dados em repouso são sempre criptografados no lado do servidor e, além disso, também podem ser criptografados no lado do cliente. A criptografia do lado do servidor pode ocorrer usando uma chave gerenciada pela plataforma (padrão) ou uma chave gerenciada pelo cliente. A criptografia do lado do cliente pode acontecer fazendo com que o cliente forneça uma chave de criptografia/descriptografia por blob para o armazenamento do Azure ou manipulando completamente a criptografia no lado do cliente. portanto, não dependendo do Armazenamento do Azure para garantias de confidencialidade.",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Determine como os dados em repouso devem ser criptografados. Entenda o modelo de thread para dados.",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Determine qual/se a criptografia de plataforma deve ser usada.",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Determine qual/se a criptografia do lado do cliente deve ser usada.",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "Aproveite o Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) para localizar contas de armazenamento que permitem acesso anônimo a blobs.",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Considere se o acesso anônimo de blob público é necessário ou se ele pode ser desabilitado para determinadas contas de armazenamento. ",
+ "waf": "Segurança"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Aproveite um tipo de conta storagev2 para melhor desempenho e confiabilidade",
+ "waf": "Fiabilidade"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
+ "severity": "Alto",
+ "text": "Aproveite o armazenamento GRS, ZRS ou GZRS para obter a mais alta disponibilidade",
+ "waf": "Fiabilidade"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Para operação de gravação após o failover, use o failover gerenciado pelo cliente ",
+ "waf": "Fiabilidade"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Entender os detalhes do failover gerenciado pela Microsoft",
+ "waf": "Fiabilidade"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "Média",
+ "text": "Habilitar exclusão reversível",
+ "waf": "Fiabilidade"
+ },
{
"arm-service": "microsoft.cache/redis",
"checklist": "Redis Resiliency checklist",
@@ -8990,7 +9422,7 @@
],
"metadata": {
"name": "WAF checklist",
- "timestamp": "August 08, 2024"
+ "timestamp": "August 12, 2024"
},
"severities": [
{
diff --git a/checklists/waf_checklist.zh-Hant.json b/checklists/waf_checklist.zh-Hant.json
index 692a96cf1..74783449b 100644
--- a/checklists/waf_checklist.zh-Hant.json
+++ b/checklists/waf_checklist.zh-Hant.json
@@ -7067,6 +7067,438 @@
"text": "利用 Azure DevOps 或 GitHub 簡化 CI/CD 並保護邏輯應用代碼",
"waf": "操作"
},
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "應用與存儲相關的 Microsoft 雲安全基準中的指導",
+ "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
+ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "請考慮「存儲的 Azure 安全基線”",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "默認情況下，Azure 儲存具有公共IP位址，並且可通過Internet訪問。專用終結點允許僅向需要訪問的 Azure 計算資源安全地公開 Azure 存儲，從而消除對公共 Internet 的暴露",
+ "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "考慮將專用終結點用於 Azure 存儲",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "新創建的存儲帳戶是使用ARM部署模型創建的，因此 RBAC、審核等都已啟用。確保訂閱中沒有具有經典部署模型的舊存儲帳戶",
+ "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
+ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "確保較舊的存儲帳戶未使用“經典部署模型”",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "利用 Microsoft Defender 瞭解可疑活動和錯誤配置。",
+ "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
+ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "為所有存儲帳戶啟用 Microsoft Defender",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "軟刪除機制允許恢復意外刪除的 blob。",
+ "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "為 blob 啟用“軟刪除”",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "考慮有選擇地禁用某些 blob 容器的「軟刪除」 例如，如果應用程式必須確保立即刪除已刪除的資訊，例如出於機密性、隱私或合規性原因。",
+ "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "禁用 blob 的“軟刪除”",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "容器的軟刪除使您能夠在刪除容器后恢復容器，例如從意外刪除操作中恢復。",
+ "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "為容器啟用“軟刪除”",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "考慮有選擇地禁用某些 blob 容器的「軟刪除」 例如，如果應用程式必須確保立即刪除已刪除的資訊，例如出於機密性、隱私或合規性原因。",
+ "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "禁用容器的“軟刪除”",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "通過強制使用者先刪除刪除鎖，然後再刪除存儲帳戶，防止意外刪除存儲帳戶",
+ "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
+ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "在存儲帳戶上啟用資源鎖定",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "請考慮對 blob 使用“合法保留”或“基于時間的保留”策略，以便無法刪除 blob、容器或存儲帳戶。請注意，「不可能」實際上意味著「不可能」;一旦存儲帳戶包含不可變的 blob，「擺脫」該存儲帳戶的唯一方法是取消 Azure 訂閱。",
+ "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "考慮不可變的 blob",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "請考慮禁用對存儲帳戶的未受保護的 HTTP/80 訪問，以便對所有數據傳輸進行加密、完整性保護，並且對伺服器進行身份驗證。",
+ "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "需要 HTTPS，即在儲存帳戶上禁用埠 80",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "在儲存帳戶上配置自定義域（主機名）時，請檢查是否需要 TLS/HTTPS;如果是這樣，可能需要將 Azure CDN 放在存儲帳戶的前面。",
+ "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "強制執行 HTTPS（禁用 HTTP）時，請檢查是否不要對儲存帳戶使用自定義域 （CNAME）。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "當用戶端使用SAS令牌訪問 blob 資料時，要求使用 HTTPS 有助於最大程度地降低憑據丟失的風險。",
+ "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "將共享訪問簽名 （SAS） 令牌限製為僅 HTTPS 連接",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": ".強制執行最新的 TLS 版本將拒絕來自使用舊版本的用戶端的請求。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (isnull(properties.minimumTlsVersion) == false and properties.minimumTlsVersion in ('TLS1_2', 'TLS1_3')) | distinct id, compliant",
+ "guid": "e12be569-a18f-4562-8d5d-ce151b9e7d55",
+ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "強制實施存儲帳戶的最新 TLS 版本",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "在可能的情況下，應優先使用 Microsoft Entra ID 令牌，而不是共用訪問簽名",
+ "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
+ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "使用 Microsoft Entra ID 令牌進行 blob 訪問",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "為使用者、組或應用程式分配角色時，請僅授予該安全主體執行任務所需的許可權。限制對資源的訪問有助於防止無意和惡意濫用數據。",
+ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "IaM 許可權中的最小特權",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "使用者委派 SAS 使用 Azure Active Directory （Azure AD） 憑據以及為 SAS 指定的許可權進行保護。使用者委派 SAS 在範圍和功能方面類似於服務 SAS，但與服務 SAS 相比，它提供了安全優勢。",
+ "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "使用 SAS 時，首選「使用者委派 SAS」，而不是基於存儲帳戶密鑰的 SAS。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "存儲帳戶金鑰（“共用金鑰”）幾乎沒有審核功能。雖然可以監控誰/何時獲取了密鑰的副本，但一旦密鑰掌握在多人手中，就不可能將使用方式歸因於特定使用者。僅依賴 Entra ID 身份驗證可以更輕鬆地將存儲訪問許可權與用戶綁定。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend allowSharedKeyAccess = tostring(properties.allowSharedKeyAccess) | extend compliant = (isnotempty(allowSharedKeyAccess) and allowSharedKeyAccess == 'false') | distinct id, compliant",
+ "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "請考慮禁用存儲帳戶密鑰，以便僅支援 Microsoft Entra ID 訪問（和使用者委派 SAS）。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "使用活動日誌數據來確定查看或更改存儲帳戶安全性的“時間”、“人員”、“內容”和“方式”（即存儲帳戶密鑰、訪問策略等）。",
+ "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "請考慮使用 Azure Monitor 審核存儲帳戶上的控制平面操作",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "通過金鑰過期策略，您可以設置帳戶訪問金鑰輪換的提醒。如果已過指定的時間間隔且尚未旋轉鍵，則會顯示提醒。",
+ "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "使用存儲帳戶密鑰時，請考慮啟用“金鑰過期策略”",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS 過期策略指定了 SAS 的有效時間間隔。SAS 過期策略適用於服務 SAS 或帳戶 SAS。當使用者生成的服務 SAS 或帳戶 SAS 的有效期間隔大於建議的時間間隔時，他們將看到警告。",
+ "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
+ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "考慮配置 SAS 過期策略",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "通過存儲訪問策略，可以選擇撤銷服務 SAS 的許可權，而無需重新生成存儲帳戶密鑰。",
+ "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "考慮將 SAS 連結到儲存存取策略",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
+ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "請考慮配置應用程式的原始程式碼儲存庫，以檢測簽入的連接字串和存儲帳戶密鑰。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "理想情況下，應用程式應使用託管標識向 Azure 儲存進行身份驗證。如果無法做到這一點，請考慮在 Azure KeyVault 或等效服務中擁有存儲憑據（連接字串、存儲帳戶密鑰、SAS、服務主體憑據）。",
+ "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
+ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "請考慮在 Azure KeyVault 中儲存連接字串（在無法使用託管標識的情況下）",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "在臨時 SAS 服務 SAS 或帳戶 SAS 上使用近期過期時間。這樣，即使 SAS 遭到入侵，它也只會在短時間內有效。如果無法引用存儲訪問策略，則這種做法尤為重要。近期過期時間還通過限制可用於上傳到 blob 的時間來限制可以寫入 blob 的數據量。",
+ "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "爭取縮短臨時 SAS 的有效期",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "創建 SAS 時，請盡可能具體且具有限制性。首選單一資源和操作的 SAS，而不是提供更廣泛訪問許可權的 SAS。",
+ "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "對SAS應用窄範圍",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS 可以包含用戶端 IP 位址或位址範圍有權使用 SAS 請求資源的參數。",
+ "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "盡可能考慮將SAS的範圍限定為特定的用戶端IP位址",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "SAS無法限制用戶端上傳的數據量;考慮到存儲量隨時間變化的定價模型，驗證用戶端是否惡意上傳了大量內容可能很有意義。",
+ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
+ "service": "Azure Storage",
+ "severity": "低",
+ "text": "在用戶端使用SAS上傳檔后，請考慮檢查上傳的數據。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "使用「本地使用者帳戶」通過 SFTP 訪問 blob 儲存時，“通常”的 RBAC 控制不適用。通過 NFS 或 REST 進行的 Blob 訪問可能比 SFTP 訪問更具限制性。遺憾的是，截至 2023 年初，本地使用者是 SFTP 端點目前支援的唯一身份管理形式",
+ "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "SFTP：限制 SFTP 訪問的「本地使用者」數量，並審核隨著時間的推移是否需要訪問。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "SFTP：SFTP 端點不支持類似 POSIX 的 ACL。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "存儲支援 CORS（跨源資源分享），即一種 HTTP 功能，使來自不同域的 Web 應用程式能夠放鬆同源策略。啟用 CORS 時，請將 CorsRules 保留為最低許可權。",
+ "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
+ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "避免過於寬泛的 CORS 策略",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "靜態數據始終在伺服器端加密，此外也可能在用戶端加密。伺服器端加密可能使用平臺管理的金鑰（預設）或客戶管理的金鑰進行。用戶端加密可以通過讓用戶端按 blob 向 Azure 儲存提供加密/解密金鑰，或者完全在用戶端處理加密來實現。因此，完全不依賴 Azure 存儲來保證機密性。",
+ "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "確定應如何加密靜態數據。了解數據的線程模型。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
+ "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "確定應使用哪種/是否應使用平臺加密。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "確定應使用哪種/是否應使用用戶端加密。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "description": "利用 Resource Graph 資源管理器 （resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true） 查找允許匿名 blob 訪問的存儲帳戶。",
+ "graph": "resources | where type == 'microsoft.storage/storageaccounts' | extend compliant = (properties.allowBlobPublicAccess == 'false') | distinct id, compliant",
+ "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "考慮是否需要公共 blob 匿名訪問，或者是否可以對某些存儲帳戶禁用公共 blob 匿名訪問。",
+ "waf": "安全"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "利用 storagev2 帳戶類型獲得更好的性能和可靠性",
+ "waf": "可靠性"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "e05bbe20-9d49-4fda-9777-8424d116785c",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy",
+ "service": "Azure Storage",
+ "severity": "高",
+ "text": "利用 GRS、ZRS 或 GZRS 儲存實現最高可用性",
+ "waf": "可靠性"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "2fa56c56-ad48-4408-be72-734c486ba280",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "對於故障轉移后的寫入操作，請使用客戶管理的故障轉移",
+ "waf": "可靠性"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc",
+ "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "瞭解 Microsoft 託管的故障轉移詳細資訊",
+ "waf": "可靠性"
+ },
+ {
+ "arm-service": "Microsoft.Storage/storageAccounts",
+ "checklist": "Azure Storage Review Checklist",
+ "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3",
+ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal",
+ "service": "Azure Storage",
+ "severity": "中等",
+ "text": "啟用軟刪除",
+ "waf": "可靠性"
+ },
{
"arm-service": "Microsoft.Devices/IotHubs",
"checklist": "IoT Hub Review",
@@ -8990,7 +9422,7 @@
],
"metadata": {
"name": "WAF checklist",
- "timestamp": "August 08, 2024"
+ "timestamp": "August 12, 2024"
},
"severities": [
{
diff --git a/spreadsheet/macrofree/azure_storage_checklist.en.xlsx b/spreadsheet/macrofree/azure_storage_checklist.en.xlsx
new file mode 100644
index 0000000000000000000000000000000000000000..afe31be886e7adc0873aa1aaeff6f29853d55781
GIT binary patch
literal 26066
zcmdqJbzD^I7B{YzW2QM-uJKH=QD2iK6~vI-|t%MSCj*Umyz
zdTy(vE_K_Tnp|r|YamqoBZT|idUiK1BYeMd=@QQGAsE{^nj&Kecw=Dof(^f;HTbB6
z{j)1>5!UoXdpw(_p|Krhy^ZM-mQ>(It%38Hy1;~SKmVbdLfviNXe;zmb&|4{YlLK`
zxulC`coa>%_>^5(cN1hDiCuHbEjAGm+8`(HY@Hy-{#3yo`8DBbYWn5)_yi(_C-2R(
zj%z^Iu}L4I;YPb%&n42UATM(E!3^zB7HV*nhj^tO9LJ-Fu|c2d&vfoe6(*YpKho9k
zQ?d00*sPgv+_eJrWlWf9AS;(wE3=|L9
zb$ZIY#QGp#ywU26ia<)8CLZIl^3dF7usiCATAglJvK`Ggc-3itv9M*2@wn)pxV*2iX%9~h=5O(T2_hUZL-Ne|ih`Wr^U>J9~af1zmvFr+?>m&u<+m109j%Q@+<0Q){
z9%cb1%%@Q!Tf*?8nfdt;cgU2~lQ62@YlcegO#0<=D3T&1ub+*uZ9y6W5-qO3%D9}t
z)OO1$H~?UCvNuqY!A$%Wo8&IVE9Mb46na{nSZW}V#N5rKuh&y=5o5jaXQ9wS2@ij0
z_oO(|MxzM(%}1_#_TS2}CreO>(N%lvIR
z-f(Q2c(#G(WQW_YxNZge`=i|&mKV*b_8Qf`sgyvK^kyw5t^SMdQ#O`tN8pITO@Z(=
z)kGOsb^=^ZH+L%EnL);j{?f5XQB~e&EoMMJY0~As#5
zaO2qqmDE-kqHP>ybft4L|u=V=3BEXUzV4nR<6CI!=<~Fg*x%Z_ev9|xN4A<;i&&1
zzsXIqZ4Y3cz3_E+rdO!$g4b_2gf=&l4hPO+3n7Ar)I_sMnd
z1n_mg!rRm9GrZcN;E~#$H^KfkzIpQ0Il;uGnVK1jJwyRqAzvPH489SHcQjzHd;N74
zC#QD>qYPUhL0Cj>WhM|K)9r*MC6FOfhGUG<4cl1DBq^-5Tz8w>GKR-w^>@vR6Cv77Z_PsuNS0xU39K+x`@iJVjHIH(qP4`Pc1wqAuD#z
z@;|`r#3#$V+}YWjBp{T;CcLV1*(8QU(>zJ%N!Vx>h2dpWW##c_q%!`v6=?1s9FNxJ
z$8iVn#VO|iiCdwguUFsE=gMV!j!-b>M{k=9gQeDAVW&u~c|VUXlZJ{>l&X-YxJCH(
zeiQuo)v4!!k!Yoj$4euxcl+4*L=Dd9_saF}Ps->)i0{6lTs!$DpJwh_X`#)-_T7Fc4U+oDlxXa3W(XcNh*&jJrmT}ABy8o
z;=g})XIR$z8wmZ-IhB3XG>)sMP>^uRBH%I27ggK@HjJ;^niMTh4aV0zG~%kb3aYWb
zSy^%N4nEl+?kZdEX35+6oMnjlEsf?`Al@Ktq-?+non?GWG6__VqsJe8QsQ3x`yt6n
zNYG;=TSZ*4B6HA#%-gj_`IbHn3*duXbABt(CwIONExp8AF5f0)UmdJ^`bA-e`0hVs
z~#v;x7FDv);8BuJ$9w=j2)2g4+)hL~`6QQ0td+<@Qa5X;$
zGP2trj?Q$QV_3~`UA-H!AAfG?tT+pZ8Wg(I{
zeMi0JNH3muu^Ptu=Mwf(SWM?w=F%lug)5hcE|xGiJ4Y+0XQrmkPORsDU94juo46#+
z*p=hbj5V-@d5P&dHWsdl>5?ALQxj=a8a==xH*F-zB3n
z6oxjf(j_^O4+?jkYx;3KD+9dY4Wg&sO$@=q3lVFezMVKijojf41-lv2ag7caZ(wsP
zvu(8QCf4||6m09;Uef$V`bXYHiSb6>rH+pEK9`nez|Pvh;%r5`N%Jhel(*jL?pzeS
zNA)v&vub(<|7L{S`1tX+=|-d4GiXo9Y6ujo)kf4HrCYS=7_vNl>a>&32kR=HdH~x>
z+Dr9;0VDV;o6NWk6r!3s)0U%_h
z$pu34CvLB)l+&keQk=jbxh^d#L2LR|aNf_Q01cQD*05#kncmiJyTq1+uw*@+7hOGc
zJg$w^75v$b84?U{6yRIyfW2R1o<7r~SU7Ps8ST+s>}s3cf?GB6>*dpWu}|X19fLNV
z&v;9Zr|nKkL*|6^E63%Jxz=EtnsBGxYL6pTVQ()tp^egk>9ukZui;V^*f``M2kHiw
z6kaK|k=v_Y6;LrZ6L=xWJ|M_`BDk|Y-hbMbC{ls7*Mzm!gjLvz)#EK(%}Op9>Opt_
zAawO1wDgzQY~$Z*1C*g3LVzCMwD!Jv_4c2{Lk`)~ZrKWo+6fY-&hn(x3!2e^_T;~y
z2@+FaZZ%R)|Pn|r80DhoqR5dj9lInh*FrE;-m45|E7THA9JUKUM0b~URXwQ^Ts7FZM`
zSjascPs2JXje1lcrk~t9xpopaQlx3Qp}U6GtQH}lo>>5IYW_@tohFagp;J9PTxxgb
z;6_ISS1X5m)e5J2dpju)K)_GmOF@yK`N|RD)EAiDr
zK)U+zlfCz!o2a-$(Zm-Y07_93;HMlzKQd-=cr&NR;iGTSSio&{Aezr%
zVXJ5;+bOL1ktC)+nR`RtVo7Z##HD
zKaJMm;59K5yWA+c-s7{}ND%<@M=5=Kq)b|qYu6ULg;pc9nA@0HrpLA2eK^iw{+b}E
z<3aL)<;K*E?q-0Ts8Gx5EEYrObkaautV8wUNT6KiBX3XcW6`bP7hDoPBvVjPk*jTH
zJ(iqNJSVC}qhid~M-ERP`LMFge;V9dy(%-oLN;aV>BVRpf6KbgeHxUfU(
zH6Q8PhJ;mxI;WPw_|<$x_6QCOWoWw6W|}5%AAehdxWJ$WrHA8oV2!gJ0L0FbEP~gC
zDBP}}oedmxhg+&gepykwizp2X{{F_m?Dbglw;I*##m71EQ-Rfq{TQA$@?oPw1GntB
zE6oXOHazMXnTb+BHKLg}l>KC%_cuX0dv&%}_gtS2XYs8zyl(0}K_TIF+TYA`Wvdsq
zZq4Ior?=&)J=y46)s!FTU#;YlL`%)`gf>If$0KMojvXQuY`4@KH#~MJlNOS~v;iZt
zwmeZA4!hr$R7q`vqtfNM$25*DHJVaQu)^79H&jVS?z7C+2Wa047PUR>%J7_sf`#Ei
z@`gv7^9L5D1*oOO292Mz$X*nArsI~!nxnb6
z)6w#an6cNsJ6d_XAyt0v3c3%4v>!I*mfjt8bkM)A+UDie+-flvx;NeV%f+yxZYwZFlu0_L&z;8tT}QFBVr8WybLPMRw_oeGtwy_
zBWlLark|D0i19)nsc7>A)?nIo)0fSzR?naE462yoIEyD&mX*)Ey-;7&I4W@zSRK_)hn^QCGd`^zOP8!ICpIEk>9c&h#
zSw_y<)QnygEjEZdQDO|yHs5ck1PJrD&N-q~%k(W4ju>xmv$fbNXyAE(z}EWAo?VS<
zQ9VyWItL$YCv@%4y+W5fq@QN&(n>9N22PU8yB+t}smlNWZ4S*a;73RZZ~wf>NKctZ
zZ`hr_7v-X9K=>lO{6r>G-v#_WmLO?!r$!?Q$}OU6YYEW2kr$xf?4qQ(SFJ{r!<%;J
zz}fW9Os_VHxRP#fbIg1_347t{W^MD_+bp_-`yg?10n5(`BF3MICtRN*4gyTeMr$J?
zbS$Hi;o83YTEVHsCq18dAp{<56deI(UngT59=~&Q=H~;O5W6i;
zmmEcX|6xF&NKpL@`S?jv&&F~i7~~0Lmf!b9NgsYe&+_KcFfe!+2u&Hl?iRh1v{%Qi
zQcHfDy?%xKvH7OF!)7Ft)%&P`>iNDth{PfRiOK*7oyv`s$=G`pzcQw|;fvRaf|DE
z8wZSlM9lS_E%3bFR$tx$Pd$rjfqkX0zQ(KfN&};h%E!nk-&|Az!-`5%wW9_IfBlT=iPs=)J
zQrvUo;nW@O3p?JQn{#Yn$*BwzqLxdJyiYGpBjqNootcvb38m*RD=v*wf(6bj@lm3=
z;#fzV?S}$^agLPb^jyg&YAq{|y;MX12~`cKy@kV{;T!gO1
zQ`+gC-F=bPW;J^EV;sSHbq7WBjYHZsh|oB-v)AHd(Py5?)}^JR`)YtTnDVxzaufWt
z!Q)`_V@m-8)tX(@(1?>=k7K4ZS2)zz>mCaQ%A>Q7yAKID(BiPr&i(ayLUpv0SG!LP
zXbPd$kR1X<%J5EwTGPtsa5?rHHr>Xjr}-&G!F#9uk|!`@n&U+&n3K*Zp@z7Flj!^D
z5Xoi>K;PX~ixjdE1;lJufai9+|MaW)SAd`%*_~t%PrvQSKoY30PQ*L#>HPg#hsY=<
ztMqYWo%;EunJG58aTW9HW1Wf?2VW+1i_9DFx|_JNLxw3DPc~#7Bk`%DvIIY+C`Ek%
zbl#_!aP1{-d&hEwVfZv$v}N|}j4NGV0=4t(&G6Mk@)zi@5TCtL%_rpi8us?Y4)(;9
zT4R38Hv>!s)oqEb+{}n;cq_wz+)fxyoH`0AGUk>ZoDSz=Qc4_B4Lu*NM>se;wPQGk&#AmiXCpRda
zrG=N<(}82a9{EAQ^1i@#vA)Avg@|N0ndHEXlUvBi#jtm5$(i#|h&63;&Ls7l3C+2;
zQ2-H3j)64x1hg72wgiJ1!nVQz1_vXo^|IqZb&6QGT*pYKou}(9`kTQ6mY4<`Zb@;_
z`Ta!;PrYb4dJ=Aa1t_PR&z_@WqXxz5^qjjvMO|x2u4oH{_Gkm{{so*_Kx@NY3duBx
zIU5CXG!G4Aoek+Q=__z>3x_YN_3a(E^_;+3M%2z4EArg+7I?eDVQR(pmgSyh@DYWA
zMluf+4KmfqvTbhGBm#YJmXXM+Q7Q*5VJ{y$a6kdXy7*DuG=;+HpA
z)c0~()SYyTmSzu6Gl?gbhT1cwdPxb3_*pdX_h_$F_p;c?)Up!C)ztH>*Xt0aHmakm
zi_|)|`fc#8{qM2F370R-)q+s84lx
ziA(L(`?M%8LS))i8Yyxo;Cx;ZXY-jLnIP~jWfu_w3E_gdE52b7D(k?>@1tc
zH&NJyMX>}giefXj0Nx%^N@E2Z4X{K7PtBY8*g7!uvueQ>8%~AJ-Yd*_WB4!)Jjrsp
z;h;tA6beyu@=^pGYSD`7ZbalJoi-dPv6_k1sF1
z3O~`H)>~VVE7@gT%D3teF4TWe
zI^>GpVJmPa62PCk>1Xp=W&H&*Tmed#y*FzG$t#XFo|e~?mWdgyn%R3-!Hy!WWo7|X
z1{m+vpF|_eztS&0vw^bD-1!lv&B@VCjw*Q&XzQlv^LFdH!77&6zFlX
zD#;z;&1&0?b!h3U6m^^for9MPjmD`5q%RlC+iVgRmwLn~GPc_mdfplx%9<`5t<+E`
zNjm}Bn^so|1=TUQ)-EdP+1ZU09!bXBA*<<{g`Daa5~`~4(h9~5zEtsCxm)jTAyTdI
z`Gbh~-lSKseWZPFL_`iI4G(GJg#F73F0?zCF2>5`V!{2q`qBhu~lQRr-R37OVU7@)I9;*mD-oXi!oOUR8E@GfhD3`clL?<
zUWjsqm1BKAo$-3PDAnA55UK~4u4!}6XtlisgbAO_`ba3x@?g_Fx#hc&T;}F
zSXzM!(0qybc%+%j+T85UX6Gc)nh{u5L!W(?FPsk{ghMU<>Hezxu2RaYB~Agnpc
zw?vAk?W}s5Jw*?J<56d^XjRu4U(K|4I|<|<0eBreu-!1?4(GaUeyX^3ck|S}x^>!y
zrqIYS!Dn&}FStVLvOG(8>3&d4%Yj4u2(_exEfy(O|3)qkhih6HXKkwvl`+T|=+-br
zF_IsWKJW|!qdRDm(=CV9l|6&W>f34|E!fOhGmemi+Y55|rZ>z+7Tt;`rDVJxNUa~S
zf*3cv%0qCFtB04Q3wz?giV^A5!Hr?Jrx88(G}8Q`+NZ7>z_HoXG~h>3dE1b7$Uz>V
z8=xO^y}I{3gjY>uR+ae3&_GY+V~Kh$re;C_IVf2EMNCc3-KHV-Zq1BC}2RIDc+=QOhf=iEg4(HdT5(1-x#_(~s
zS|>GAR%X@Xq-YCatCo&#ndkw$qjLBKtV|1ydxu0LzAHl#Df4Ry)M+r$`cI#MmQk6n
zY5IUb!
z6L|}$hk+6@OM^8EntOpsLML&ACmWY7m8`fWqL)ddoS2e7K($9X^pjdpO1#QJs2*voT-v8;1&#Hr9#bt&NTWb#^Oc%C_jBv(c#P64yhhrlUV7zJ53c2VO5FlwnoV?A
z8yE59SoHEH<=d37IEN%6<>;k@Bc+D)NF*T%h+^asM&Hptf%EOXg1;~C{21|a7B
zJoV7#MAH+{f@|DtRm+^iDQ)6|K+MN+5i?^3R}D5r)26u(q6#!lcc&M!^NmB>5XXjYtZQM|jlnrZxMv#yYk2YM5KA)YBsMc((-S>sV}e+g*K5WsY4fhWwx*
zusKV=uo4=ch76`YUy1RCgwerUCV?#|v2P5fa>~aJn;gao8+>GS<;p(aKJS$!G?{nw
z`pmf+5UZ9yXR)tvO@$1=ws?&??=<+48jVLjXZKvhv`zJ(D&AI-`(9G|vX3Cn;pmz2
zmvX+o6T?~{ZUZbZUaTjsYvhf-~hUx_q9@5=*fOxtYv`Ga&#>;@ly_*pwG)F
zzfdxWwLyw^y!Kel!lG1?En*Q2&pV~j2Vm@eGUnR{Q{+<%SL2O-kXPMn
zbjdgvYE@79=H4>gcP6x0IL|uT%(4H;rR7A%1&fMm9E)=k#a8t)p}w@WQ3yl#5a~0e
z;%UWOpkT9!q-vXmC2_-es4XwljCVK&IOoS)a50_a6OU$Cie!qrJe#Iv;x^t&om_<$
zbaP`7TykJ0Zg9$JDm3$^=%F^zo2hXfPTer&US1n@^-_zA*%wGRX#_BDR({a{r1hg^
zQ|mFdS`cJZFsa5&7M|`oIbun(Vztkp)*cz
zwl;s+7>Qa9gq2zv6+VoME1;bv7y(+E7rja;Uvk?D?TerqCtddtM>J5qQWx{W^rZ2T
z)v&_IY?P~-;|2$uY6>!{
zRL}sQ0jI=u@ZsrteGZYeJMI99%oB|QPw%+6s+M)1t+9rIFur1HG1lwQeqHd@to7%g
zlSV^cMK7i(cz?(jVS5%K3(4gvO`K>#;03tNNSidLywRCw1Z?q!Ph@pTs6}VUjv7Z
zA8V;U(<}1M7kO65x(ucmPs$&tU^)?cB-?pA=;y3bM_WK5?xb}S}p~Nok}i@%-!XJ
z0hec>+JXDSciz7oFKWd&0l(iJva~G>rURT272u~snz>+SDI|c_RA8O8{MvNT6hq5M
z8nk%eSe^C+3k!8Urplzb;Lde$W$;OO%84F~4#PPnd8HE=qr9S?w1@eD%jntt{1!{$
z>cyH9{}l1fN#@#PL$B&l#z=Tt&m(WWm9e#xS@H?|2A6{Tda%MZhx#^k?PybG_sdIP
z?95mCN!x332|K%MgxVdP+={m-t0L`oCqZ`R=VFN0C63$$F=HMQj2p;Bs3b64qOXi~
zIqkS^$e`9H(%A*I6=c_MzC|)`**eB4uWK(+wKkJ?n4LbYI<<)AHSm15Exd%#nr1oI
zT~YQ~9EHfr6<=-bmL*DyE
z?weaK$8863%Z!R1lR^e}&I)Gk`&>td4jlFN}KKD=3_Dt8Mhshd=FB
zhbPV|zO@(jv`lh9EIMnGoKv9`pQ5|HUuMWhPH7|#_*iOJW}}OPURWB?6&SoM0~?|_
zGVkN|9gjF_lvv2-66P3|?p1%g4KUP|4bl2G1x0;jM4jC@+g}hw_7VBMOwCRetpXB?
zxsYy?RtCPcUJljD0A}>p?iUsbEOqBg$b5-kn%~WM;4-6{nv`deOtCdBz5jWwcGFM?
zg0^PMl{_+pbW#=s;Vl$@%`Lkth@_Rg?NTN~mfBkKl!`@Qk^&CGkqE8e+kP
zcW=V%?uMP{E3j>kj06{9JxD{#i#BtsRr(}XqA;$|;8|-OJvmqlzM8Tg
z4!J>Rbrd#$8zKhgrs*xiSac4}yoPhel9tTwZ$@1;mU*}-NJx;9V
zNopVu5!Wo_PL39y7p}TSOqTy>TEuV;i>&XY)m&6X!qF^uMOKxhrsnXljYJ(bp
z3zy5c8kaJc%ZsKi^KEf%U5&uQic_uXhUo*%S=Rh@6o4?m?F_Q&IR5FR0(Vd6Xmx9u
zI(>ac6hFm3$9ncz*r&BmJ}Wx+lQ(UC0(9(oQYpa#Lq&
z70GWMR7E?2Uy)JKSGP-g0ri2bEa_k!&gKjSDV=>yuUio+cN_Dt+$suat{ijQOc9=?
zm-Ff8s+Hl~FJ3xWgZ1-8j2eW;UE;3O|ECJwqZ4>Ck(H~@lhIUJJ7mF^8GN&wCdE)B7%q{k8MfMq>pQ9Jv5Kd
zCJ6>>_a7H?ei~AsfU_Fcs+nK2gHh`W<&5>&udtDSqE4NX3`VOgYuO`{qe$~?on3F8
zA+l`C$6sd!+2If~gi53oEZWb5u|Vw`z2fVv;#%4$u=wuRT}LsBh_q&L1BXf>m^9%d8!>RNbC1
zirTG_ACz`Tr%{s*wDxdJTC?_`-^+!n2SK|C4^QU#=lPb#1IkNNOIsc|wq(xNqZm+3
z6n@$gchIr@x`ov>ySdMqVpr9$Hp48|e>c^gLUk=4luF?0sXefA0LzAnjzTQKD1s^0w
z(RlH_t80}RG)0vgD=VJzS#VW5)x-__7?(PWm9ciz-meQtex+#n9
zd+#w;2Xh+`c0&$tDG02xfny0_YN-@F9oe=d$K|KH`o{!{Csx99kPmjk?805(>8y!Z
zdc#7&Lq>i1B^+$A^ux}*-tyW&+^}{2a{Ig@)M{+5jmK$|vALP=#t=an^*rTmr
z(_dZ2KaSXz#cs^9XJ~7O&6U?5r=RSnh!Y5&_s_19>K&FbfZ?6B>a{xuBZ(xN>yEZX
ztYd|z74dR5$ICoS>l5cl3xpI27Z{IwOLT1x)|{Q*6Rhew5wB@d-ZS%@WMbJ!n6RyR
zG0iMX@jHr)Ftj_@AtMZ0B?%UEnImK9Rr9~N3NjGXnP=iiZ|m6VK)Uwrck1+tDO!TM^gyv{1&YB9SXYG)SUGh)lLuP2?o
z11ru{Tz5?;(swk$Em+M-InQy)cBc!aj=DB%eH0~k+F@Q~XNUC(XZss9@u#~z3yZLk
zeA?dQSqOWxb&b-Vc*_1-=h@kEwg7C#XEe^V!cnn+uIbbV!lDq=IM)Tv-68jGTz0o5
zq_4FLGg?Efp97o>5)A?xVI%6FH}PC!bGBS1rz|ZjQQr@yow~4UI_0i{r{T+6$8qgu
z>sW!_f-z@$&GdpvU_Y4|eC?x7E{cZItjZQcANuYg9twk5v+y{=@cBE814FHK=AIIp
z_$tN%+`NT-z!(ErIR~$Hxbj7>YzYIiR--|051)`+6K>#YCYe%FPb)a1oq6_!VoI{|
z0atC>nGui8`l7VrOlAY$s_mP-W}_a1jAHG_ZaQ${fp3CSChCa1v
zl|hY8UqId>3nbtAN$0BC<>g5P`EAx0s?Y@Z#~EuiS1E#f_7d_>c*!2kX0R7y!ccrZIF*a{p#ZGEL;^K^bMLU#yj4AW+&x8jMxgQHd-MjiZn
zuq`NOnJsFaGHc;F0C-C4h?1m@*`99vz8*5NDJc{k05b<2?JHVu+VWVE;o4=G8ZT#t
zr9{xlc)r~$ud`P#Y-?f@f|Z*Z*gCc+4J-!=nAY+RuUc;k7ztJ(<<4J`X(R!u^pqlIGw1^HE*^Yx_q6t95ta>8!k
z2GN1{Z+Tmy+$HaAbA@Mp${wJIu*AOQWkuqZraHd|azzncB^gJflcis$FABf}HT9-U
zP9+c@ce>u1Zc(HS?D)d96x&<_nq=VB+gZMe{2mJ-`55{7G+#+L;NZdG*wOHNUov5V
z=DCKi~18d#h)vn&?Xz!1z0swhBqpU8z}aK{_8P-DI_i1fHrhNwZNE!Qt(v1P6zk
zvcpl?P%p@?K!uXaeyD7E*;a373ukn;@St04lG6#tILNF}hTFF(EVCbl)!Nvm*v1ZA
ztT7yuEM_=MeE!BK)J{}4s-1C$siB~EX
z4m`*igO-zVjs6XjF}O~V9Ij`Z%yVg
z24d>j1AaPazasVtExK+d37ezIe{Rq;B!ce757Cgjn76;orXSH=mVSww&P2*oA*g90
zsU@H~0e=~J@!kBpP=+W$)ncz-`ts~gE>pXfWrb8Y=Y>LXs2`pW7nCGw(JpzYN0=Rw
zHx$L9ubY13BO+qLK)l?>x$+`g_y;c8!a-o!Ek$7TCF;ko6bUfL-jEhir8AKgfPjys
z6p`;KZJ$c0`H?cH{Q{3qGtItC#1~w`?9v@KWIRle|;Ko*>n|g`0mj^
ziwO88gcY#${-!40kjya9`7=q@UwvJf;gFR!0Zh_`iEv{g!}|
zO_TY-dH4up%<+cRmwrUg-k$iNISiYq=teJH$k{J23vTq5(fsr}{u@?H<_FFqg11cO
zNKF?2e3Vc_H$zP=MuKZ{ykw{hZP9-A})V06R))K4Mke0z2IuMW1!lN=&R=q
z*56vBfPuZM;ObAC;a&)nq-(dUg-%`j5P$!Ge=^Ub19|xae*RHLk+&ZpGybm)sWS;E
zO*B7UFn~zFPw~doC_fqKYWabOLvKFA&X3GN$j!$ahy5mZ2TfY2>keACV>mbFclQFV
zRl|%Cm-rOa4{j*ki|!z`B1L$IIP~z3@%;jXI~;lW0}!VohYQd6-J!n!XI;sbq=?$(
zR~J=`bt>|H`?JOiD3F&wcv{kgJ$SXO3Ck0YH$|NO$_-KEou9c;4)w(yKpZNPjUgz%
zasw8RxcmhL7#SiM8R96`4+eV4)L{0ACw~xyJjZQB=+@7R}&GISIG8}0c{v*;}i5O8`CZC^p
zAkROr#3DdL9)70eA{Jo}#gF7bN1h|Ly_6=1FWC_Za*T4GYzQ`w+dFpAe&kvk;#_*&
z=orOx6><0l8r;78ADsI5-#S$uvWOL(jXZqM|6UR``1WrYAkT3pS{?*EQ~mCl=U8k*XNW7leU;<$E(o6czf7PUQIqa%3hV4?jU2#lkB5
z1uF8qJP46E*~r6%{|HDS?d{-SkRr~db+_cM6RV3_;)n$z1d-o%lT;}Em%7#sAqaX9
zhhOx-w#$BHEAkwH7b06d{>;{Y3JE5mrD>#Dkn;6%#i7^uVoWh?*|G^wnz6$f;-axK
zv5nsQ(?7kLa4$z(&ggo%_0YQFO-cg!JCR~9v+;7G>GARj+msfgb`23vzGb^6OR4gq
zDo+Z7GFB;(Oq%k8nDirr;^?+$4%2%OF}{LiWsy*^m)CCRJf}Aajwj%LMfssZy7Cdd
zzow?elbe*W>ha1svRV4qC1W(YgOsk9ziY#13y{Sb&Y)rU*EF+mr9*hmd`pV*gEG2G
zcl4_f^ly2NGRJHPmvrN=
zzz;9!{hv5gKBDx0(i7;9eeVZ5^97tLCH;4ge?mV0fto1G^pSFM-PIT8(9Cg_T;*KE
z{Y{fYfy0fQ8H97E1@Z_C>%R+%@%>eh-Cx%)!SM#F#Uz3~miKqRv&Z;e7V*pi=Pyd)
zp62NKJ=Es8AMjd+?a4*n%uBPWAfEZ%GZ%sj&-(p-c-GIcD1iPeMs|5!S)`hdS0VHl
zYUJmG=~Y;A{!nup??R2yPc=pyi@`U3soBX4VWd$hiNDKC5-Ii(A%2le4!5J|HDq4{
zFEV5Lz8J`0I;I>xvPVWeNGs^+z8~-*_O(p`Nn?U;4Jo^?Ig@2oT6K898cQ{bc^D#8^V&
zbqOvY?YZ{@((ZdS2<_hkxG?
zk(CrOTvvf~^M2aTa!;-^@~g6b5{!pXjs(j#xya!*9)h(eKig3jpVkEcA8ycJ)EUAQ
zL3th1AEppIoST|L`(bJ-sG}O|4^!`a&rK2XUGS3Jd7F=k#r`*5=0B)mT%=U6?~lw3
zHgvd+@*5$vENaMfn){G_^CF#c9kOqR$lU(r@CQBz;VZ~ep)HZTC>6f2LP<^ChzGj~
zKN?8qt2G=%0cRma&spfO&=qc*^SJsec@Zo`JUFibgy?xG$7c3x@pI1k6=O~pm0;u2n1LXPz3*03tNNCSlK!~0fb*=;C
zIx>i#Y4fjHnE1b7VdI5;ALBK_FZT>Y2LI2DG-~R;*{~j7%`AP@KOXAoKpMqd6ycCpX@GZFuPSJQDz>iyS@_RtW_CpXRqpIew7a`l&uo9CC`89cXP?bAOgqI@y&`LVN1r#aO`
z{H{O+nuu7_r6a!kz>=NjB>jiL-U0ve#`iGMJL{Uf`T>H!`zYVPoSaPcJ%@`V2#hZw+qV!jIxU0!?(?|G-!|L)DtfdhdcGYPJr
z?{5nJxQ}oiRX++J1M$pxk7VmK{mNqg^-mAn=ndh&Q2dJpq=rq$KV1Bqg@3yL&mQoj
zNJ?K!)BoDT|7Z7Y*_s@P>$-^fevyQYT&cy_UgKWu5JLZYABmn-q~Ci44d+vQXC20u
zc?{C;-HYD#$xT%AujJId6bb)MgD`@E|KIPJd!twijO*bSkYeZAOf
zAPe#xM$@?*=lRCqX=wMmo**SQHk6Ao_8e=oujg{f=flo5V^vgrkx)NhV!n%w60)Y)
zQ0x$#Ak?1EIz*Wq+lU<>M(?|enJJhg5+Uw>E@yr|>bxh4@r}dEeEJl%|9oq7-duX$
zoy+lE?A$t=xaZ={IDZu;Rk(%gqoJ3^iGAm-LE?)|7~j&+kFBo*@)ir|HP>9c%ta_T
zhuT!(H#nm%HeUz}h+AyD_rv&Tde7Z-`;bd`NF}mZMD!EVCqxd2#B6){y?fYw&`C>H
zk@xyl{8>25BegUZANV2S=W$Tk)<`7p>HKQ4h+C~G$^y_g-^X1l+iHpAD9t|vUZptV
zhJ0@yIJG)d{Rs@eN`q@IIbWV%Mf{>RXI=^x<19Pl|MKvTgS@0wq(t(t()sMfJ6AdO
z(y9N|uMQf_0YmM7!tiebx#E9fSjG2O3`73F@ISu)R}BAS1@ix+1HU~VUI*&txA_MQ
zr~V1UzX{~Z{RP9nW9fBW^p%|FN(x7fIc5K4s$Eqn;#{<63ufc|}P@Bdq-AY!_pY4c@c
zaq=)?E&q2Y=Jxzm!5CsjLI8&x<&ZJ{U7#WQp0~-bOpuTJD-X^;T|m%X
z|J8wC&u_l;L}2(wz5YEDbG!Zt!@mi5`~|~^zhb!mN43fS$M^q=;eV{)FAi)av)({~
zD|$3qP%EbfH3H~TK$?VylfG~}0B_{JE2qtdSuo*NN2hEWcZ{!jjKNmkjma3a4?{0J{uuYYk#)xg!rk3
zqckU5oO)5ye%+L(08vw8lmUv0S<3CD*8Qt{F9ga%M{g_*eV%7Kkozi|2E4*&c}O?_
zh!VCSB>;1+y>R&^Zv>&3T-jp|athmWY+1B#*vU<{gW0U>yn}PjUK(o^I_;TMn0)c6
zRf&GB@pO=%1NPYoezM?ReFjZC-Ym%rck((m^_fBZzbNuyIzHWJeCG9y&C=eYr6U<9
z-e$+Kn-!nycLAkT`memRJZ6fawH5Ow&8>}y--%gKK6zB!lwT_F^=nz{tpfwQefBt?
zBYP)LH)x*UYafVj=sRo5cRkJL1A*jKNkfuUj{RGk>Od6oK|oJsoc_`J
z&fE>rU=E)qqAyn1-I)91k{(QNY{QSWJXx5+(W3Tdg7MA@V0v=7tgFceHk;=dqz{
zf|2hHRc`FQzB`%7*f%;#1}Ga_>WIDcafTs(osAx6t<=J@5|_bN!TDD34E~fVX}*yJWX4Tl}tlb&|V0B3Jt{^C1g^qWZHA4E%NzAQS?hl03rkxuH4T%;U7m
zT
zcwK6yAU|H*We?#OHu8kzY{Ns)Giwm0$Og6b4FWsyB=<4Rkx_zI&=|#be*%>q-m^7=
zQNJTvG*}_&d4jK0`W1vAght
zC#QHO*+a^uSN&fex!yk&)F=$BA`4FO3igVO>kG|GdH#s5)rZIT7Nh@FiJ*FHyUTA+
z6mo{zCUTA_WTl7J_b0dZiBXb28{T+TF)d&u<)(+_SZ^>0Dmy|UH_PG$CcrtwYN`&)iI`}aO6*fa>@o2(Z
zvK|nDk)+GZ0ipxZ(@SZ~WNFLgoF(Iw90S4$<8R(hOGHwC+_nhqbLQM3m0zY@GI~g{
zu$*06>1QBB?qSOhqwfputb>buIzZ{Ump3+X$_l;INGRxP$AUSuc-r$WLL#2cnD9-V
zU81tu7d45v)hiV=%46p2FZo~dznNbAf;W_x9D2E$X7{7use}3@ex=GUgNq;jzq+nG
z9IE{f&k$v+!H}IYh*Fp#B5Rh6ge+qnYsxaRZxN+rNtURT$zX_)WG~y4F=UIf4Gp*H
z%C4~$WBW~d?(H`B{?2)xbDs0Z`=0Zh@8|n|Ki_}e*GzO_aK=Q*^4fx1#z0t1X=h4l
z=iq##V$FO1+XbD&t$G>cMkwE58UC4XH;1ahf=G+leBmpGz)a^C?1IE7&N;W&JF@F1
z>i?8MQnuYU#aiM0=WpAHx^^uReJ@6j7n#8u)tJJ`I>a~;YiEx11xEy#ydC=}GuH~OJt}I=O-)xirS;0(r$cz>kB4b2M?uAqRQ2~6n9O5gIxF5`|@?UTuO=Y8jz
z<<0Tx>@ebFaQB1cELd?8Yf71M*o12y=`roAPQ!KGN#6?VK%YxOULJ`ag7vmGsclF^AGF1n3$RBkHLL1?)>0-PprKU`
zvm={`(w1YBk_hGsoY@$sM~yV(T!8VLO?(+y%<$3P_o4Db!KXh|#&2)&Ow@6&%S^5+
z9vbKsn<{ZuGS(xSWp%CHu}H_pS5Rmk_XDn3+tvvq^tP^YiOGqu^$u9FO51n0(M+NX
zFL)GTA}g&ju31jXLR1ra`Ssn%!3%dTW}p939$D20jsloLJ>}7r=#wDvcL(MS&8cE6
z?vDE*J5-c%k!@T>iJNVNEliNR%3W8h1y|kR49ir#rzn(!+ZTT{JFa9h(<^c&p!?(?
z$*zpV-`x;dL9kH-2g7rrR_-3H(v!_fPO-;2WFfOygJ%82fTp6=OxaQtcP8kJK+|Ec0_k|?Ju
z*RpBt7c#0lQuIM+eUA2KPg_RKLirzjW+A75H?~7ZvVz+Nzj@{7x+}HM%*N_xUGhHHod8)*+K_0nZ
z&N((KyVzmY)Ryn__U(}x386=Fk@j*{#nRt0+h`~K5k^8s->kFp-pYuGTC@H<*
zJ)?QX0429>nAzn2WJce)GFr`MFi0l<(&+GB9<WCYhAFs2YOtyyFzFfDgK_4k)
zu5IR%0`}+^hjQUWEuj0D+Qd0GF}@qI(>n)_Xh;t}k*D?9tppfqkzZ!0?=6yC#k76u
zBQ3h!txTR5#eH<1q{hvMxK)x?_KStQp3AQfpDeADu+l=D+70*MbyJc|VV-r=)+5#4<6~#iuc{&Z?`g@S*4z68
zbh{{$%43QB^|CSh`Ym*|A#oD?M$G*d5fX!jE1mIM7P_gJYYu<5*lCtxS5guSmpEL3
zb`9ctV>)%5N6R>F)rN)7#1O&BnAt>eyhOX%R1AV?{(XBbL>oTxxSgv!)BXc%&`T+O
zo%{BOPn^-_ylDyoumN1zM9aAA!27U0JTqB5VYGWA(O9vk^
zw-ImZKB@z_9S6#F8O=2c8s_IV(gOkYYa%9l!k|wCCp0|!cZ3zz8SK|<4QCVabSdPg
z+plxb@5lfTpTHBxe_V6Y;V33WPVMJB9!Qg70+V9taJk-Xj=F@&{D*`zH^R!dJHvR1
zOWg1sG+O@o0a$K`NZ=^ehp0esAXzIv15|j+I-~vb5OT_JZFvkVwRd$GbnMHrRJ(i&
zYOvNMaP#a6d)n-)z$%YWcJL~2t*j+m(pb-qnjsiB}{g6JJv|sr;%kSEM
z&~k4;0o`X_h8X}j@KgJLn9aKS`FZa)jp=^gqY5BmbD|7WRQ0LFnh>rRE>%8U$-bph
z;kNFxBBFibk~yvvW@}*~%{nJ|EsRKfk8BBn6@niX01XdB3Rq0KTaMYjJuafcdLN4`>8P?zTxc(X^=1ZcYqDQVO_@1G5FN^((RFHJa)N;vds&^6bTO}NaCnlVe#D)ZF4;3mW5
z1(Tq_(KyMC>D=U|tEcX?!55fKNo)Jv8vlqra|lo9NlN-~=HSIJs^G2)(1ZWgF*VuLaE9nOe-t=9aiLgG8vVKnT0
zVdWRSor$h!^f<-3nGhW2&>5T-)AF@b^Y`M#eiBBA(~H-c-n{%U`?uHgLj`%Df{>Qs
zS3Ck8e-v=5Wv6M20%$X{eMl~3I+och0^@+$8;yrNA|@i2P;lCJA09h4OS=*Y{{+6T
zb6sI=OG~RDU}cZ(-J6$gQ*KxwRQ`Z&$Vn~$rCoqusUK6!YEr*zvL~S{Qx6S!7`eoTIp1)7rk0}d>3izP
zAzsTCrKm1spyuMZm;2%qgE8GpJG3|7aX}+%89-%?V>o*40GYtd|35i{{!@34m>*FT
z|H{!|L^Fm~{KNtPF~F98qW_ApV1zSfH~fNc&|m)_Ne+wzjLzAA6T~*{+a>rh2ma-w
z&B(&Iq5j1(Z~31ryW49<7RILfZx-MQ+g+AlEjA;Raq;;D)ph!9DPjaNiuo_#QRLrW
z{+F~ff*FP57kJZo7yN%@gpr4FQvTwZa{13GY6fSa2X+7e?DR8^u3D;YKc4;vj02!f
literal 0
HcmV?d00001
diff --git a/spreadsheet/macrofree/azure_storage_checklist.es.xlsx b/spreadsheet/macrofree/azure_storage_checklist.es.xlsx
new file mode 100644
index 0000000000000000000000000000000000000000..d2367de002331fd993e950e76aa4b22e09f4a4d0
GIT binary patch
literal 26859
zcmdSBXH-*b*Dh>FY#^uz2#AGVMLGe+4T$vKLAp|_db8l7~AD$tvhpG_cgCs?ggkQbMn-cW5Qv4qiTVq9g+ZPU;hA&=lxLRAuLFLYW=DKj^M}x9+Wn2(#`lY`BLCJMc
z4ky0~W@}&U(&8yG8#lKv)bBY0Z!uKFN~~~9Tl3s&z4&0@HdeHw{aw(zY4-x|G4GIK
zDw1?M+LMj%tp{KFabFPVoUAOG>*J6#cY;QXyOaniF*HtU-WMunq{|(>agG!Lyek?^
zE+ZJjdU`KdrQ@nf@=Uw!j>+i;q8bXtKekX7F1kr{9FP6Pv16ByZo$~r-juKhzi?{h&)n{Zakt>6i$YaYk?eIM
z&Th>Y?@p&As%8SnofBvu6^Vl(RJZr92oQ}^-txXTE+yvehwYqFa_^vdNeBZk{i+WOV
z*XxwiIh~5_sQVA6oM*$Mp9gc_rMeT<#B}b$;`5l}CuwW8DmAj{7t5WL5~Y6gtdDC6
zUE>%3{A}R+fYU*V)TV{9&Zlv0TuXG@HwT_b&$d`Vw92l^4q>2lZ>8Q;NHt5I&!gQa!5s
zl#Anoy+@zHIiaw5)p!})hqzri-OS-^M-~|n^D&HQURl;REq1r=8wtm|;;F_KEoyaD
zmnm`ZiypmlyH`Bi{9O2!#|kP-4A0!Rtf6+TRI@Et!=cU@41LsCG#klg*}8H?kt~$|
zYlRN8dvHGo{Ub@+XA@3?bLuh<&Nv+-`iRKu(D|@2Jyt^({h$jmJfD_h_hSK+f)e{dL=HCH(cRz_5pbOfe_d)m{Q
z+qqm8>gig{7px*zxH%mt|AFGE-;C&K+qBDJMfcyDTZI%$E*z&1(sK!f#yx%XT;!(Y
z`OEpzz;sTuIRE3bo^i;tuX3-BER6GOhameZSHgpQt-Z74?`8y17N%*wSM0d%cRzUa
z;k~cnBC+-c+*NOW%w5jtoV`#)DijA0Rhu36zmVp#&5`8K@>b^F0KE&Tv6e|fX#Fui
za&~jF(^?C1-2S8zEus0iiCP$*{)?I>-!nl>**X7@KI#)8U^UzGUE%<4!WXGm|6rIhO1AhlsdbVfOmT7cm#j(wZkHKQNrV
zSxpttW66EVFFr9;Jtw!)MF#!c_D;#EQPsI2X%hw&=}6u?Iq=eOreTWa_XUPZtdKyz
zsFia!9mBVTzgOet$8Hs*=TVUHGxA
zNe6jqFgOp?h$*|DQ%*8rY01O?_3Rm7!W@AZdV0({u}GcK2}x949YKY8i(8yU+>XQ8Jy+k-6UEFf2-I->ip
zNjQ?FVgldF&G5Jm>-V(f-8QX(u*jHy-pz8qoQWFo8+dEheO$S#%ZLv323o{2uT?#)
zt5G;)D|&Z)@4*+v+_~&1bl+-s*m<_I_j=Xr7u4I)Gw#V}=9Mf>k?m!bcDY^H08)%~
zmbx)Z^8)-kaU^VfQq(@0xaXUMvtYPnr*xyovs$@U)@uDv1=UHfRGb&YyR4(n%MG$q
z2-|$KseA(d$aL>)Fv<$Wu~Vv$xhAvi=rJ`Zsv9}1;c-oyE#D_!RiM6#GkTR1b@4>B
zn-tH4#^
zcLuo>Ir7uXwaB_<%A{&I`BOyd{APNO7hU)ejP@
z+nuN#S$MST;E8F?2fo50<}EtJJSxY=rUTYcuGf=R=a&rXiW{VpSZiJ7S7NVhU%6*{{(_irJdG$242DS+(!
z)Cxs?n~P38C7P;Pa=pL=xhD$uglK?0r?Onum+TRV6q~|@DMLF;Kt?Y%N%i_JC+BY5
z)UMZ3MGP1zVGvS*adNI~7~QkB+1=<}8I;fu9h{ERsOy}m5~J7?#+G|*X#zYQTp%}W
za}e{z5RZW+72IGKN^#d~LkBP$iWuHtb)N~X4_rjsG!^g}x$xg}F>vc;HQ)Kdw_rgn
zUw$#O_F^lD*SU~(Bos()Q%+o2OUx^Nl7B)iVVTy-Xv0DX5-;4lYb~2&En71ZD-TQ&
z&QBJ;st+r#pR@X+*qsyFNo!@|DlpT}H$x&myxq5=hKs8~iVo4-cwLNnD!OG7R;b@4
z0!`{X(`2OUb-$HFG{J(Wp6*3y9JW``b9p6k&pRnwEOja%<*Qf;4?4hc=Lb38O#w8c
z)sF9%VTKZNb9G3-AUs_~*5sjco97nFamUG#B{_|e(R~%U%N|E5)0ISxOXWu@A?#KA
zQ(TB}r&reC>8_c4K+Htfl1rw?v{xs8!-5NPbg+%qG+u_l=`8NT6D?~ij^
zPWILnN1sgonK+l3OT-h${JFsWF*j(YX)NO5>uOP0Q%bUk`X`{U==`KXbG@hc?
z7TIyPTt@|bW~JTwk+yYh7Zu~>b=`1l8%(<>Sod*q0;c0G%Iz-d4G3u1CjaiR<$h{J
z>mw`%4qKF_7$?s=OZH0j<-n|LE@h`X?|Q1Dg9RY9canr$fN4Cpe|0ug`!AW4z19@$
z+E{$@oY=0c!`D#fm>o%1&*iN(pPf3vMVnwWN~3jhuM{`<+4*y_%NwtDh1w4Di8!$h
zk+rvasP4~e?~`3T>y!k2?hmm6CmmHC22n3SSCX-)mCRjSx>2352Wc{84D?3ra^Gy^
znCA^#VeQVH&~GqoG7jwGy3z6dMS0*jn8)=qQlN)tq#T&3GZ&~de>%ay=kBaueU+hJxS-b>
z7A*>u576L8k9d{~j@OCKPpNlh6b@nx*H##WajQbTpWO4Oa`+uRK^znY>Nv$*hUe;*
zi%*Q{rYsP2d6~PCMR_mB`_(}wDly;76Va|l)zt1*`I%Z~U4!H<_VAigH@=9Ov;ngO
znPabfZ(dF1W$z4-J-=oydmaD{U0wU&)|t3!%>mlO07h280c$o1DeFr7HGpK7`7wxS
z-%|I`b4T~gu<*&JDpCr&32t2@y{HH*S4u~AYI$^wnRoKo*;OSaN!0{3+v&F{s_NO7
zhGG^kf;o_{)wZ3!NREs#!$zT0OFiH6v9?Rdk@94D$rLGzfiHXsy7lkslgYY~7wd$x
zF4C=bzwcDE-JH_LB13FO|g~^{hODW9j
z=@1G@^)vU~yHZ5mqg2#*AJ(gTRSVK~dZ;zczSY4Py1S3kaP%cC8`
z^_N@PW|n$bbX87e!_8D$+pUC4>#Xi|We%~yYAl~a;(I+L-jJrBD4Su`vzt#TT2D(B
zF-8Lfg$nvx`Gt2l%$V@fOuJOGYFw!C5c{PkAVi-fGB{@Psijvb*rt!%YDtHe{02uY
zi3^fDAT7Rs)#&Q-6=iH<
zATScBgB2r5qb`Ri*5;Y}ew%X7W{gc4Z|K`Aq}7zaEmjYjYPbQ9k*fyrnwvCV8nt#o
zE;GltSeU69+(cjU=v>e9`c^ug8!qzI;)keNN~zR%IOUW@6tAl*7`T#wSYOi%my9Qp
zR?&fFP4!rLp!(@>J&+g9eYtzYb
z#fYI`8eO$zaR!2Q2at$Q6}&zH<8-wGpA@{&CPiZyQ>^urf#YMP|>(h2J%xK=-dowql5^B{%yb;oQ3SaWAZS
zqQYORJb-32F+b37$cdcXU5eS6Q3siAaJHw}*NYW=(71rr=T=$Fp@PZo$qVz+nxGK=S}T%~v
zEw?u_Pr#XIaSr5%&`duMG%W%o2Z`Ha`1EsPL_$}+vJs15PANpvxXnhYYMuJ|fRgJD
z7Bjvi6qIO_G)w+|vGuuxTiRTi(KL%9byhU#B*%mezfWRglQ;#m23Dt(C?IKijZR;c-WcV8D5jKtA+z|6>OhQpS>G
z3Vkzh-lKM(EzcacDvoO5`?T*Et4C@}#O(_*ukpHFQ6nvNo|C0A(}7#12UAJmmIfY+
zd~e={gX>o3+y-O6e#La}1~xVaHsaP8E&(>;hR5et`oY0#0l{lTZ6()$Vg(UyrB;w)
zD|bGPTsm{huEFuXVSQ_cnrbMd;zJ@1~VN
zQ(aEY6meX%UZ3{7;A?bRnDxJsG(;U$Hx!=I%0C_VGCJXIf|;6Fhfl0al;oX`5v!g8
z%Fk#f3^f&xVw%cJ&`qTaizYl91@*;%l-Ip60lgH`uiifCNro`^WE8eJ;7cmwUN~F<
zuTwY}Tb6aZOyqs%oMEpUPuaPVwf2cjy`ko{FJx)@F{J21*{bm+QImj0rM6j=
zM@*74wrQhbDM(s@W``d$mjzu`U6R)Bt?SG5Y1fkbPGc86>t3hDrGvOsA}xaeK=uXjrq;l#avF2d4#ttu;o*%w`^u4G-pWCZ0TW|zWiQ4f
zSx(mu82e-W!G5x32F#_-8DbOX-XYq!0CiR%TwsI*)SphrD$+?Atp{@XX27_54naA>
zsc|*4Bu28(IA{vpEDegGL1l)4b{}#YgpoW=N2%NfNa>BCiJZj2pM$v25N{{VH%
zP&h@`;h$(BDWKN-1^ZzaEV=5`S1Y5^m#b81r_}J#ple_+2Ob&Iakcyv_63uf_snew
z`^-lL%u=%oT>?pPea>)LkX}8>7n%A9c=oE#_^zCDR(E*=(?DQ?Zhn{kmEI{#IE7;G
zG=s3!Du^3_qDv;?xBkl>_t}kk8!h&krK9msK8w}Pj4;%$9U{4|B7SmOdY>Xj=);ShQwT?{O@P~r
zLL->JXM6uQ;Bb;;aKjz|r&U>$)n)CR8M9a?D|fdNX@~q8ucsFJ$#FSQ1*sxbLc|za
zvsd+On{~X&vOFLlOBfQhDSy{Ps8dAN#nGZ-g{~Y11=}Xg_H>M3K|4SA78D5$lJ!hP9Eh2v{cNk
z@L)6O7DYs|!Kv69HsK71Tv|6fq0jzv+|IITY^?x5Zw>TCtsPGXq}`gA#`=b(H8gX;
zwT@Oexqd*8f6~!cu9u1U35&G55LKT5z*8RK2#W|%kg5ljnGvhWK29stma5qu8MN?o
ztz$0Gd^PUS1Lmry4qv$6^
zv28){#NEO!r4LUm5IF^NPd{+tn6&9TWLLoij$+=40vD{sX;4ul
z>m^X4S!S@lxd(bJA*F$DkS)^Ed#AFbu|VM22jUD{&f$3;-gF7cG=;`rFSNM27O-kxWDl|*&bfI7
zZ2@>KQ7#lieQJCB^g!AoV;Ig3K;KQhVGW>RRn?80@-
zE$5tXjXfzVHVYFjub{?%UjkY(w}sV?C$m~OExBL8RX(TcKiw9r|A^nE=-u^->2nn7
zNa!3cDs2XP7Q`#A59-J%TwIOySP(Wyq@jh;3)%vCE%M&`qhK;14jJ5{afX@CDtCYp
znabLbO=<0@b#70oXq&n`08#SQLCLaIE{?21Uz(F!zIIBw+X@&!b&YJxcbE92PS7If
zn6hpC^oAfk-yS?O^taA&?yA=ip
zR%&Pg`(VQN0jqiId^ypLmU%bPF<`O)VcC=YA}oJ~mvRL9{2t2P-bIMH`-B>3BPG|#
zTcm#7YKsmrIkM?ltYlNY^EhQV=BBSi+$UWgeGW<5=b8)di>8)Qz1yF$Rv1IaB#=;!
z;G;p4T+2)AAxdoF-IG+(DIQQYqlg5oQ&j0|mA{}IQ&(1|QPUf&6&bHN2af$201k^6gNvEmK`B
z2?fo)8jFh+X2-4MBnb`cgpYQ_BBG386M&g3eE{|E?M3z4qH7OD)(0oyTsV
zulDsjeO)TqoP0OFb^_>>3jGmzI=EK}r?MyIq>Y8oHqN0o1caQ0O&sMWQ64?HERTd%0)wt0cmwSItncXPJ_p!WL^02yA_MN2gi^cZV4kxDdx{AUx7GoM2PHKbcKQUF)et7ODDnqlqhP
ze$Z2X&=wYvBFeqa_aV9xtVjtFg}*UaTF?GQAvD3+{d%^vJ%2P^=slD(sBH@M$T{cy
zsZB&2|Mr4P_{p7jCC{J*?QU&is;j*XrTuf4qr65_)R_ysY_8FxmQJi>R8cH2F?Cnc
zDWpglsCkh<)YCw1HUpc3zI4JW&k70y^TOIovq^IGJb0<<3R$|CH=Vt9-h{SaCU11Hml3rdcm{a@{qOk%=?
zK6M2ACJboQ$}>KZ?IqtBX1*QlBqFAqib;u?n%UlK+%0x}h22APBO8KvOR!$(ml}IQ
zbR=F{x!^=6_nyIy9G_k++Ss!Q)m__2RR7RU&i`UBA0NJiFDCmxAG-qRZjJk(L&84h
z@vMu#G!Wj&h_V8#I3nH&pp6>uALIg%h*uV$3$ZBo)!xkUUHJvW%=f`1g~`hEqVJm_#Kt=3^|-LewU^a%mTr@tPc}E~XA`JE=s~0%1H7Z#3s+Ou`qj|U
zVN>hkxTGz6EqiTJhg`){+KR>cnoXIy!nfP+V}gLGm$1hzM85(e(7px2A99tWs9LA6
z_M3B>(ci-=YpqnrHu6T(V)9YxlChnGT@RtX{6p__b-a{)V&fbF5tBQ^ph7ig!Nma=
z;nE!|j?|9AsMY$cA*HTX3A%=1^fn};q_&k!Of&%J}ZG+K#@C0SjG_n`ymNbS!a{8>!bBXcaTQqQq
z0Y?jI_KSbU-i@)@+$yLi%8#RQZ&Qjc|GJ&M-ON75Yf+6cvCOZmu$IFQP?m*-j=fm|
zrN*3s2Lulhq2G=`=k6}KuWs9)P@J1Irh$6G%z(CC>KwGW8oAwRb8Xr2!?~=`&Wl%U
zH!UDpoIbsA>vXoE$Pu_#BpN*+U01Jt-1B=7|H@)&TGQv7j*WvfOVOx>vUNFz{DtB2{7^{wh?T=o-%YExlfN}0nGJ29*FCS$N))5OA5-2>
zl_Qu`Pvy70QPJ1w>X4}~W4%(R@<_QN&;}*XsOPS_R#I?3S=4mfIJYYGmgaio4EBsk
zTAnr$QrpxHy=J)n@FGkdRfVKxFOU?irW|WAbKDN*O>?=o2}CM)lsGtPRP1Hn0`5ZU
zgd;>_;urVc+rnLxNCrqs+e!573M+I#VcPL1BkI~drD$h`7~oi-&D^eH$C!;SYiXf<
z$AF7jFTWXeAzY2xIXi9t5GZY}7*m5wRR(r>Wq|uK
z*f7CH_9W1#CWUsr?0v~cYdcBtMJp%E_O7HSlR5FpROt$8)=Kr28n=`DD+i_WrIp0s
zx(42kFO{c@aht&8H8~xvq^4+>2LaY1-^G=ptm+$X`KfQ`lc5q8)>c%fN4aV!=#EWgN;}<=XeXmbvt;o*&N{=LA_B&s4K~vHHBk6G?^C7d@9Uy
zYQiK)_zUWJ&2
z!dYidp6Vg=(u>QA?cG#`P6ge%R|J=fLB(Utd#aA_T%d+BE#El5p0$+)<&LOQ8B1r8zx};1Y=2<)x@V=>P_vfki4VZ`lKys&!k4Xj
zg&P%TSb`+tJ1$5XyJ_0E(1oSV*Y4~-d4pnC>ReRg6IxWEvvD#BblK$BXaLc^F$+T6
zy@8y$wC#VKL<7;553k}mZ~oL0gY(83;=6sNXSpzBprJ=QI(4m)2whi~H8F}Rg<@mm
z4JZcxqCB|7_sl(iRH)O%J|<*VZLGk4J#n7Zavt8BUGLXC{_cOUL-6`T>)CFH
z;ji1tJJY8h!Tjm!=^r{R0PJ^imgY+qaFsi2Vrb}C7^J6ijlaLS2AwBrH!x}o`n;OT
z`mK4ef#X@$U#UVe&e5I)Y_sk>9ciA&qfW!otfH|osBU=8r-jFs{Ky=Tle*kyM!btA
zuIRCyzfz&zrPdZF2k>A+`{_V^>sZk%*`s=4t3D4shhWdvN~{*1+d}$HG&sPJYbVsx
zZ8mWXdk_`NGQjv|CFdzsR+r>acbI4MKnQkWe0!k`Q`Os>vfGMgu5CjXO2PJ2Be1b3
z(HpWjU5(hL>dWp(d@25csn0PU=oxc}o)0U`E1&OVw~g-N!)~}(Vp_)VbJL9ELbeoP
zZVL4QB9jp7eT2Em!5Ai24jt^*D(IEm+wg~wk67!MQ{AXUx9yfF7YinHI5BF5Kef&W
zOJ!Fw%(@TFXw|N&b0oczQ-{Qg`fSx=%EN4KsiGPmFE(av$JW@BN0u)kC7C(V`8%66
zwwDw&D3tZ=g{ZJ)lVnLDZPWv
z+teUErz8rS=9H}z3_g0~Q3(bKSIxrS7NYVL;YB3vI1>AgRiX^4M??9Q2CIoMWj(1sNBzpTMzZ>iC;%8#bPcUO2yzlT}dxw
zr-IEu6M}vQVp@=|Lb`63}rhu
z^sLH#{bj}T^%Cwv&Svv*)}gH$74RHWe_m+mXblx2!ea*Mej^xNu;HvjSoxChy5l{O
z-trF-#H#>8feS*_(oRgMMY#m1$5^>-SyMM#+R39DP=+dHZ`4LywRB&W+3sYhWje^z
zv*Vb>79G3hH95%*LVId9YmyCfErmO@%4?J#0;(NSCe6s5ah;PEuX~lcqMG5vz}x+O
zE)Mv2_&e3?Acgyw3x=@mnG2YzcgrPMnNLLa@cVWz|F}veO3Zf4_IT
zmtPAu5JRfkU*mAO#W)T&e_qaIae_r^T60gbSsv<;)FBZ(hDjwePEtm8v%BoDvo!)+
z7Ogip-NM}MZ-ch4>NwmeFK&1gIG<0fLdsV)_-gDF%F0?HaWvkllDwmSwPk?Kq0g(!
zd@y2BXheu-r9us#`x!T_UJ!C$;h_)JXcFRn6(RRk6k+)eOow!c=ZR8l(&&Cx8zcwTma#pGjt-fDc
zH@<4%I*BCJS);M)lF||a+d5ms_nYfWJzrg`-BU?6
z&h{2w7`fZslsqaICS3XgvYg*VhyTF=qFp{()
zQaKzDf_gLfw-_Go4Umg-Fd#E4Q~sJ#b4)?XPCB%9%mksQ^m+iU$=yZ*G=P7~nVHzM
zTCp&|AlE!A-u9vzQC!$;Y+%GUC>>9dHE66(qgH?EzU>{QQT8%64h@PgkuG=gg_(nl
zpoN&4obo|__Hk6unmu-6aC@queT2vv+LaxdzvXA-l;`ni&(?`ApLWxwjj(noEMNk69!F?f)u3!n*F3#^)Os&VR
zn_2gL*Fv*=R-PA-k<(Il1B6shNR+eN)qHmUApD&_ti%zBZQ;k1^Q44YTh=?Nc_OR^
z)T6D<)GH{V2n-NFXFeI_d1)i`U>2RTP=r;jB|=spj4odN3VT8yAMOdX!B;F3wkxPr
z8+^>EL~MiDGV4?fR&-8xy;ojw;HX5Z^b8nF8gNMTldb$X1t_N(dM}c*cT`mk
z&D>Lsz05)URo8lxs
zMJ-Tahh72`JRP{1ho4fGmYy~=tTm&wVD)GvjNH???CCXj4#SlU^dl+@TIe@)d}jn
z1fIvza;(11&?k;<#3d%_SA=k?es&%I;
zQS9F_f_y75^BAOxeC2XBPgsGU)P?Tx9XyjOAFwp&-zD-Zzh!oC&K
zp%Wk;kS-~hml$>)_fVZqyMIrkiyP4pkC;7mS4__tgW21)tib;W6ezdlc75;dm5gWe
z+w*&A{BD9{@ct#2{H1Ozi;>4vXuO7Vs&`@cWMG^4()EWWKSZkmwYZ@Cw#DEvM@Zsm
zN#n{gM$*7AYw)TQA{`?awCc~=pRXSDLbElZd@QMB55hj#1I*!gVw!PXtyv?HzBsei
zbMy0sK)_f5ZtH^J%8VAujmHw;vTn;&>%h9UTFgs3GJ>A~x(iw=1RfbF@E^Q;peI5*
z)_N7O3s*NtBng;rSfNt7QeMoNotV@e8X415V8LqSI9Il|@V@A0L`3M(j`Cv~!e-vW
z8!NEHvy(H@rWq+}Ny?MclI(4UOSC=oxao~&qcMKlAse#~`4wwwaj6W}6Eo72hJm1O
z92*j~-zgS1)+KBQN73=UpAiLw!)C29fe
z`L-Z*HBP#wXwMp^G9nhjLF)kGU$gNHcY)lz4SF@Rhn23({R_LNeU;BCRqgHo%(=!o
z-B#g5%&=ACI4C_0)yCdX#d&@cS~Ic53>&AZ7R}`ABbf$N%PkHWDEe)8lH;z%?`G-+0=RRGcb!W=AYd~F*;2Zh?1+{rc-1*ti
z5#8D0?K#ItPrL6+L-C2{()-zogei{A8C60c%k~;<(M>onwcM_9-j#}Kc(rB>KEQ0FufE$ccM7Xb^K>mgQ@vE9pxllRhDTMFiS2;=4
z{als*(bWgYCL#phyVfj4tSBCN)^y?<^M(skaR4JsDVjEE*%MqMzCTCPQ#)cu(^N`r
zl{_Mk-Tf<2@fvMX3@CtXP={RH-`vXbvbaA&cYiE${&FVC0X^&6t8<0!?gL__TakWJ
zj6vh?n$QEjZzh=UfaOOH{V%?`C`3H{jo7b}N%YA}viE;6ohMPa2GO5eZSEKI5CjS%QDG;Ergep)c3#7C(Px;B0(F)GX8#x
z>G+e^WbfES@)TS(QyypmRmoisIq{}cHC!(G{Bknw6chau-xB=)|1k8!V<%kv_BC^o
zCu{%SFM19AJ~f^@+1^9A9PIA2*}bgKT%XRJJdCH&D<@y#fy;`~uvkw-i98P^A5`B=Kqav7g8v@nvaqeX=nr>Pek%7g6YGJ;lD~V*
zxmLG-T%m6i5@#3xQWW-bp9j3PFs@HRCw^P|zu03|*z%>j$xrcQ3gYScNmqcCqMzZb
zt7i_y)$Gf1VM%e4cz~8b7~qhwFK7B`88qF06PC5HZ%pk3-dN75pT_*GgtAz;n{!V6
z!W9G}VOqH|f3;ks4)`nxeJ=9qeyO}PlnQLd-#*l7FmpfaPe~izO}j>KqSg+|3Z8$g1&p(tCM!ve_&vw7=1*Pl4qCNM7XeJYEC`)nd)yY=Ge&=w|F1QFxDva>CQXX;0gZH&xQ4G=h^y7Zf
zkBc=#|E3>r_=!jwRV&QGt!gJ$sebaXs08E{c)Av5fSWIL(EW-kWwe;$B;gXx!{&7;
zrOq=^VrH7VzogVzwBt<%#a~Ji4KYV}+u?3p{mq*{oa7+xZ%qk#u;YE02mf5=N>~dg
z;P{nQa4-SIVIC8}G!ZUr=6D>x!p`DFfbxr7Jea%51Vn;(9KW*#V~jWdD_aO&RtT34
zf`bETu$rtrgo6c-ICLO5BwW}Ke{)!T#Gx_XAwg$&bLD60@lFp@WwrIj5mE_;CxMoD
z5-`Rbk#}?65P%YXpa7rBYppkOf736hj$cW*L_6Ta`>Uv{iOt|eby)g3@rojY?#tHr
zPuaE}5m6XkKL=^&*>}sAASA-iZwQ
zNUjgJoWupPZYYa{h`&C4IpZa>Nl@%H-az`MlGj72SMb05b^WdQ>kpSRe3`FilYf2)
z51%x|-+jY%T9#g=sVqzS0)4b}=a~*5;2%VB-IdLLoJ4wwCFTlA8mZAIU*@Oh
z;%;R~$Qhk2wld;l@*_RZ=$}q%H0R4~_(THf`$7?u?s^@6mr3@x%9ktL>=tB?UYlMi
zeaP&q`I!5TAE^wpEU^lUGNZ3gJ9Bd*ldqT{I%cpNBHGe8h=r#vQH)DQ7S|BsqEaRl5(F)n$Igm$j;bYp2wnxAk#^2
zHJkZ}pAC=p_a(iR|I>4Tnt6+E(!k9w{eQo$}fDIe9m23@nm@Wkl8diawV^;eV*#AklX;kr1-r;zGXK4tgs_`SiKJs`UA370X)
zr<<7H0r_$_mOJL@n`nIC?1|6(44fvhS?AsBcT#=@II*hx72Z;F;5^%bCHY1qn{h$u
z5ld4|%~#St&@;>H${t{{qf(cpbl^UH1QTOH>`nHI(sq+U#L9#)1@;yNwZ*bB{AQ}D
zkfR_rq}qt!&F>BV$xqxY4957+{>0tvpZ@g4qH$+AN&40Oa9{EV
z-ze`FwJHD|+93$?i)lCzFN$h5<%lcd9Kkn#YMeFryY96kq49syaSM&l1$*-#_DB{a
zslC>zL$0)%W=hWfju5x6?zQ4-wu23H+&bJq`z^j0i8mgpF82|#n%gG!?T|A5j1NA}
zC9fMzFaLpN!+T#*mUM@TvY@*(DEbGQ6GR7SUL1r4kLHDd?vDpYGbZ=?0h%E1!;A@<
zcyaZJ5Uw+Fs2zw-`ShXal>Hh%ocjX|?E#qi%ZFf)moE+8{sRo~)IOL3sY5WiQUbc*
zKfvHWzE2J9FEF$dF90Y0h?CR-7~rWxFhJi%^x6LbjIcba2v
z;g2}{D?8j1z*9#Gt~~w|+Ei~Ro6u*|_h*^RzdH-GoBWsTmBmZ@cc~2_$HT+7K>RS-v+@C_FFT)4T59;a}j9r#mnH=z|cfM@%;JYAOfiU
zIpuHE1YMN=^y7V_Z}6qZtOrv^$XwC;#z_3vKaCXA(-TUgIM*BXgDLBJBg=V}0=7e}
z`%M&+%D{YGSM&hsr|asXvG$l_Kg$&}-<{JwmZwyn%)xkm#)r$l|7?ct?ZcY44?_H7
zZLi3BhAX?76*P
z$DUr0najj~akSHqi^A(@eh##+xY=w|?8n1?#_bCA+gG33Fp&`sKRXR^OVPAPdz;`-
zd8k-DK6l3ahf4Ry@Lw$4TV^)@@tY;QZ*K*`lTrtTbn$7Yzv&Mi{Q94*+K9j)er$Vs
zs8O!JKgVzJWT7;{%|Y+D-gs}B^6ws?OopD&-z0cL1y24!!Uc~ON`aoBec_!l);uFR
zb>YU*IPmP7JP0+OWy-A(o)?Ebzq&Edg8s2yJ{!wK=@yvegqv`$`QKplew32w=i3i6Df^0iK?xRWksr%vU
zcCw{$zc$iZD~ry;xxD!a}P7o`dJ_KyLSD{jV3+=gbq
zLwY-mxRm}m;T{3y@NH2@4c!X2dGqh|H*6vt$}S%&|FW%zLzp01;)sdvY+JdW*AB?w
z{cT8&+Jp!oDt{Yz-Xz#SqauV&{wWK|(dQuojKzN}2&8c!3;wCQ+bBNCL>{%@$$Nh?
zF*{69MdD}fUEZX+-95+jTQyX6@=}&>B@=s<_PZO;WJJqrhwi}N6;LwKp_?0#__GG{
zOok>pbP6&aHP9{Cn&|NJ+}Zt_-+q7juRej_0pbSU;vvBCFZ;`X>;5ug-{L{;T7av@
zz6e@(3;wQvGwU|qz#q@?>~(8J;P>fpYhO;6ZKo6Y@PPk7P{u6baabY$
z)xz^XA^yX|e|r9(5eOpwIt;?UBK)sCU%c!>C79WGG)UL&@KXa`j0d&Byovg6&#COX
z1qmu}kpHQI(8S(}MDpJ~B2)m8cn-t7j{k+j?td&uR1Dhs)l%>>kjGQ@OX&n96MX)hG$>ajy9NJI49Ne;^*lSqbIlp9=^sk3^AR??`KQ*mrqEsQ(*;?oFBauGRiO7eqwlQI`L03;$Rk
z|F@=+`S)}u_&k!$iS~bQtjvEDtUn?COHKag0)opUN+8(#qwf)19_hUQ8-#$#QoInR
zj&=onHSBqV7v#avygwVX9A)|6w(ySy=6}m)o_{C-@AHTfy8ofokUzEh2SkDjc?pVU
z+&{eRi}@c52rhp&E(G4*pCyOj@`zUdHwbB0+-~Cso+Cmale~dHyx=?Z!Q1A2govXo
z|JxS+vB2TU<->#YeoYYkhZ6oAaPS!ZY)$x#`$MZoArdBo?)Y^4q(;6!OA}htAA8te
zKyZ0P33z*dPKgAUN3`k|#Yuc}S5YY8`5omoL7SO(Wqeb*W9CHI26)%wo}tdF;y7;n
zT}M7+em>(VGukKBaf1l3n8caW>ny^MH^+3mup3g@D4{`L2bA%^2Ig?MC>>9*}1bTRT|pu~{=Zn;Hu3
zY-uf8q2O$?Zny?BfQ@XdZzqS|Lhl8y#!v0)^))o#A$e);yvix&C$>psv!FHrKDZ%%UcTyOE8?(MxV>l
zsFbJV$llu}QP<^g*z`88)?vOk%M3kb?b*&D#d{gP2kF?@q%Wa%$K0y!BH;wWs+Z59
zZWsQzZ(xYVc17rabeldsI&*%-pDRqw0*Uz!A1w`SfLp1fW%>)*n*s4M{a^VTjNXqC#Tb5RBa{f9R%p
z0S|+~w_VD$1+dTHwNf#6Ywk?`T|^%H`yu{pezo&?82-7hAJ<|QD9+a5==7dKRL*y3
zvU9~G(+0ewJ7J6ey_g@VT?PQeqm6Vs%`DRaVT1)=P`_8Y&!7%1g37?89&T5&l9^Yz
z%eQ{}$8H?mF@zZHE_^y+{nMugHRkz|g}z}PT)zqq1_OaKO!J0@lnl
zKD302nKr0tp?0(0!bmK6=XM3`JfvKPW_7EFkuP1|(`DBedB|6I?K8fghhHOAOgh(@7H%xoLCGFZ92uq?xki&}c#
zAZ&m-d4G3e+vtAx-c-Z*ZVWCIn-UlZtpfUNZg2b`LC`^J)e1L6g+br5`OBe&{q8lu
z50{GYKiAxfZQyJjnQXvE8S7eo!xrfU>MXVP?AcRJNyh)1Yeu^(HKWT=4E+Dpb)DgG
zt!s1y5q-i4!RWn3?=2>x45Ig5BHD=FTeRpc2r|Q9h!RBa1R*+!U?e0N5j}czuH-!T
zX`_m(D*Sxu35C;IzCIT*UQM1>uid3?
zjh3uTq-&F`?&Ef$b5Z#^?ZKK3XF+-FwFuW4sZccFHM2#sM~YJTJjk|lbb?5`hI3_+
z;Dx8vViZ{4xdm+8>lTE+GcX@#Y1;RR@-3uck7SarRo8RdaaYu?Wb3!8ZW5pzd|M~>
zcDeBzw3&ThlNm7V`9d1Jn9pPvsXwGCpu$J`X%^ma-6g35=f&Ej$j&>H2d7Ik^gAko
zn?|XHLw@*)9qidDPc*5S(&*t!{C?mGC76ZlS634zW!G1{!?h!j(HG8AhppO@%0@2{?*{Y!TByrM*<&lFI^3
zuANG(o!%sGeWDSqCb70H9v>0(eu$5=v4)(aK4ein&z;;5SYBo)pmlWQYDr_CZEh5qwDvCW*wvB
z!8ChV0k6_~Qj_#vB-oGz5C;?*Kw=!8LFzoRd9@aUK6%kUbb^-fQQ4d6SGqAq_qsQ}
zBsnH07vX@>swrXf>t!=Gqzd_eN>x;vV7}R|bj{7Vd?OGKGf%hW#&QxHLP{nJ!_Vy-c~n%2y5{z`Va;zl>tAZWL0~IrJ
z@>=W*3}3z@6pSs)r4_2LbygdCDiA3V##RzY$aXl80a+5$Pa8*kWs?}ujDL#54Uwa^
zid>A@e-SnK`HK%FO})2NCw%v_Ml-}3$ed{&^#HzBoPOLDHC6pN1{~L?;PzB{o-m}#
zeg3q|-KsxLs&&kXjFCj3|6Kc+GWs2HGX7HZW
zJJ@#^oVQLT8J)>Gzt>=$^(X#eL1fWrL|~Uyc*Qy#yOV#G#y4QybJqNoBVhvb%b8l$
zz|rI_Uflr&rztUWImPU32j-JIr#VwBTlO!$ba}ZhoZ3(9(*LP5`pHYWOBXuB!4Cjj
zNX<_>X%A07XFHEyM$#rGNoAtIGw#Rxbk~4Co&SgY`KYww~4yzA^i^AfD%5&+lyh7vtC!H0ubV@mRZ+&>Dyky?hM4z3KEi_&~WMAA9V0=GDw^V8=s0!)T%osXI&`w1~
zS7VOsGTlS;jT&hTA*X@FbX>IfWAAmZvY8C`9jOHu>DUz`FRZ@OLUb27S;S+;ZYbK!
zdVNp0pMCFJRX}YUC0&=NU7Z=9IZs@20}X9nR^*dTJgESV>Fn^ns`T};oB^1H~{?Arv)y5GSZh;
z|Gnxng{HS8R`{9EOomtAdk~&a(R4MHpFGuIZ~KG0TSrPp(h|zjJMqarDL25;AD7Qr
z=F-$;Rchk0PUgZD=EwUs$d%AuM;hC+-<}KN9?#BXRuRpua&8T1w)Yh{_xE$uGf?Mn
z1(iE6GgPML?mE0m9+l=Fbf7;!Wfm*=D6M1VE{y9?DZSk-cSX^%CRoB?
z(v!X5!G~!)GK5lBoqssd$43NW@%lnWO^3Sm2##{>h7Jl=tP#Z$AL25ww$QaJee^^p
zNSEWV<#SRFX|~B+-lK8jU3Vq9*`_opykh1(WZ#!@^p;IhP5e5z?4#x4X2iO;O$~aN
zgwFfbT0x87VtFHjo}8iB*)w%n@acvGSMW}q4B;Zqx?JX_1})OAk#P-0mbiCx-pkuOD=pBRDO*!*>cowVrZ2
zl_5YZ#d`n65nrL)n+wwR6X!JihnI2*8kAOJJ1?a0#zigx;l4tpnSRt@|dtOX0afvC&i{`_ea8XC&Pp5&~pTWw~|yi&zsic1IoFV
zzsD4Jax&?Wfemb1%FIU|`1v07(DR{+~X~
z)~>Ejzgo*wSEmpBz}}8n_A5bkl3VrO#4oLCor&XJ%31x4Y*%T)gIcD%nH(7zvLNjRL@mf
zt39?8AWhI$)CO}jFSS+6vo;G`tOIwx7IPP^yBZS?upDxIM+IzRA9aQrVd`
zq*{|p(tD9dqJD}8M96P>#?=;D*BhlYHiyymw`*2g@L`4IQvUb)LC1PRJx?!jUhzf4-^Y2edT7;mPnqU9>=Av!kfR~&^IFi=Dp^YLc0l`uj2jRVf|IeuT#|t!uf%BE6LmeN-oR!
z&&yyRZ`=ZUp1kUb7<#g@&fTnujDr=HZK}UHrc+C0cYF;8KVPSf8D9$1Mhmt`0n&M?
z6~ny5hs5gk?rzZrVQZwfIRY{Ktzn;pY%|uf@}JV4Db#w+rXN%-41Vsk=-jMtFTRn2
z;&|ektb<=L*NZcF9aqRGwpA51TBb~J(4ZB_A3G|{gb;pPRPzmTzAzMw_=M5#=<)J3
z9rQ{G?cNxa{qtQ>UuX>JFN)XlqIvn5gJA-3g?ZY+JS}wn9@=@B{Vd?ux`P_s{J@j+
zH&a~R%VF4#{zy|KUT`N%PH(KmHVk^S?@VTluWMY&;1)x%u{Pw}x4pdw#HtxFN{W2&
z7!$5-DEe7=0QkxSMbhtp`BbZ?mHA@sk@3*tekl>6Q%6H4+K_ija}|zSE17o@enrU?
zrkEm=*lAt{l)USts%~l!U=gI#FGs=RLqg@O)^ij4PSJ=e5sIE7G2vE#a=&h}i)X(5
zI#rQmSu)8DP4jQ!^MVs~oJfL&5x2OWr}75VfaDr?7Pwgo8=YYMrT>kC;&GOmcA6b6=
zgkNU4+*JR~f~9PFsl~nwy}bDRhMHLYu@qefUKaD;z&qA|Kly*9{WAEnaQp^S*!}|l
li;P_6xjZR<^I+Ni;}q3|;$CFg000CRd&GrmY2E*M^&d)*thN9E
literal 0
HcmV?d00001
diff --git a/spreadsheet/macrofree/azure_storage_checklist.ja.xlsx b/spreadsheet/macrofree/azure_storage_checklist.ja.xlsx
new file mode 100644
index 0000000000000000000000000000000000000000..0f57271725fec7e6847dae38ff1e9a1857a17316
GIT binary patch
literal 28159
zcmcG01yqz>*R~2GB_Z7+2q;P_9nzfwg3{ec4vmyF2uPQdbazWj4bnMuNDSRD@XvsO
z&-1MReb)DV?^Z|UsKOr?6IP?{J}5oQ|X?J8pYNz>2-x&0Gsd+BVw%O9C}oos^P
zdCeUhz7nO-`8}X2j~3ddTQFm0YQOtpnBs(|t25a@dBG{45#%0NM2Mb7Mhe%QVm9*5
zn-P_*d#<8zWspwTz_vG%A5hF8N7X#1{EVZBnk;9M7#U;P@gYwDmIQkg?d^+zmt8n7
z6PG$I&U9}#+^NQs{UZd*PBjapo6xo2x^V;ZdI&leR(h})yhAliJQ=WC8~l&*8T;(+
z<)TlFHb*lkYw1{!SDEQ8p^Lo-S7_J_D{+kK0ND=#GL<;2A5BmSl!yxJZ{v~ZWe_jw
zW0BReVw1O{-;a?H;J9jWKuLe#uZVF;Y%DOQX`t<^x&bKOE{7u3z<8|4{bDpXXI12^rSZh9A
zqJNPkRAX{Mfh(p&6^$w=-#@qEZ;vpjSgG0`Z$UMCUU~-1<2LTn8R7jCw?;gS`Y?nW
zH`?ysxPb-5&EAyW#!$~p@2X{lAqQ6Jv6x`NZa^Qsxc_}ay!@dXye;yZ^3#ZCeDikS
zLnDm>7#|W+Mzqi%qk@g1Zo*Y-Mcu3cGoaEI-lDY|Bg6XCIt;;d3TqIIGY)5Y%JBqE
zGkkE9`}}BXem=l{e_Tv7h@$(pmR$1_^&%-a5gwushJy^7`_hXH&dQ8-L>}j
zb}&2L?afblN-%>#bf3)c=^z8#BkDJi51sLa=aA!O5EJhbpoePQ;v#_^auv^8t
zX#UCYV}uiAfc4^RD}DRWg16rFB#)H7_~=!G^ZsfG?{u2_k4LAq5{3ts$>Nc3otW
zEl20fx7>*KPy7(9J>Wd{N-UZC3x3k+
zc$(fzJhv@UF@p=Ag&CLz774H4B==VX`1QtU3K((S7e>L%6LUMfAwQ
znOL7zpicYjAM
z#NdeG=284U^&T}9a7vf({&AQD(=a&zLq|n7E~xH?H`Y^wd$(2Ar5N912(|HqzrH64
zA{Qe&dzYdLn5I@vw0JY^iJFG~VL`0h_RTG3TVClE46TG6D)fl;@dZI5l05q~uLHC;
zY?9QQZEbaN99(e>+$(Qx>P8SL8^pa44H`-#)4HiAFF#^PEa7#p_>O&x)zP~2$h}@{
zA@Vtg*v-J94=Z0DWk{tv4U*AjecaL=SQT6M!$=TYbA9)*Q2d0Stl%YS0wBb_dzSO-
zjCI!wZQc?yM_+B1FMAl+_|-Nj4~o<&$E35Ab0dhd*ClL{+iV!Bi>#Xdf#%w8-Br5VR-P081iqpkPzj@U*fmPQbt@~Hs^VtNsI?cLuV
zkaV2|p&Z&IG7jlQJ?qNh#9K1*7NnX~xEI5KIUqPF=kCDx0&C6|q0K0}Mua
zg2*(WXtl1?xxeI;h_EJSqPN;vT49;fbK-+>Y?i5{^SE_=aTMv}^wb=WRU}e>pO77U
zsBpJfv$J81R6A{zdSiZ7g2zj{b^ac+NEE4&r+A#^edZP7Azx^i5Cb+$H|WkvWHNRo
zPHmj$=Xg{eZ{aHAVg?ee(a5$4Sa`3XHvj%OldtSF2@x)FLD%BsU
zMYArJLFoV7!e%5~MTlPBxbeN_)(!ltEev2`Wnyipr)OhLfBENXAFERX%nKKPK7I9U
z=yb3BwrUIOjQQacyc?e0`k45ydJ|QabFKM8Wh2@i%e|2w1FJ8$lf8TK`33_i`9rx4
zmm&*QTr#Gcf;U15Ec6l1ce>6GGHQBlUEB^r=wFQhrt6NK-Q0G;6BU4o-u