From 107430bd10545c44ac4b8c41cb8f64dbe678e691 Mon Sep 17 00:00:00 2001 From: Marvin Buss Date: Sat, 4 Mar 2023 14:31:11 +0100 Subject: [PATCH 1/2] Add SQL DINE DNS Policy --- .../Compliant-CorpLzPolicyAssignment.json | 14 ++ .../Compliant-CorpLzPolicySetDefinition.json | 152 +++++++++++++++++- 2 files changed, 164 insertions(+), 2 deletions(-) diff --git a/foundations/azure/referenceImplementations/core/managementGroupTemplates/policyAssignments/Compliant-CorpLzPolicyAssignment.json b/foundations/azure/referenceImplementations/core/managementGroupTemplates/policyAssignments/Compliant-CorpLzPolicyAssignment.json index 170dfb8d..8e3dc2db 100644 --- a/foundations/azure/referenceImplementations/core/managementGroupTemplates/policyAssignments/Compliant-CorpLzPolicyAssignment.json +++ b/foundations/azure/referenceImplementations/core/managementGroupTemplates/policyAssignments/Compliant-CorpLzPolicyAssignment.json @@ -273,6 +273,14 @@ "type": "string", "defaultValue": "feed" }, + "sqlPrivateDnsZone": { + "type": "string", + "defaultValue": "DeployIfNotExists" + }, + "sqlPrivateDnsZoneId": { + "type": "string", + "defaultValue": "" + }, "userAssignedIdentityResourceId": { "type": "string", "defaultValue": "" @@ -497,6 +505,12 @@ }, "synapsePrivateDnsZoneId": { "value": "[parameters('synapsePrivateDnsZoneId')]" + }, + "sqlPrivateDnsZone": { + "value": "[parameters('sqlPrivateDnsZone')]" + }, + "sqlPrivateDnsZoneId": { + "value": "[parameters('sqlPrivateDnsZoneId')]" } } } diff --git a/foundations/azure/referenceImplementations/core/managementGroupTemplates/policyDefinitions/Compliant-CorpLzPolicySetDefinition.json b/foundations/azure/referenceImplementations/core/managementGroupTemplates/policyDefinitions/Compliant-CorpLzPolicySetDefinition.json index d2aac8b9..8b2b810a 100644 --- a/foundations/azure/referenceImplementations/core/managementGroupTemplates/policyDefinitions/Compliant-CorpLzPolicySetDefinition.json +++ b/foundations/azure/referenceImplementations/core/managementGroupTemplates/policyDefinitions/Compliant-CorpLzPolicySetDefinition.json @@ -4,13 +4,138 @@ "parameters": { "topLevelManagementGroupPrefix": { "type": "string", - "defaultValue": "FSIDemo" + "defaultValue": "test" } }, "variables": { "scope": "[concat('/providers/Microsoft.Management/managementGroups/', parameters('topLevelManagementGroupPrefix'))]", "policies": { "policyDefinitions": [ + { + "properties": { + "displayName": "Configure a private DNS Zone ID for sqlServer groupID", + "mode": "Indexed", + "description": "Configure private DNS zone group to override the DNS resolution for a sqlServer groupID private endpoint.", + "metadata": { + "version": "1.0.0", + "category": "SQL" + }, + "parameters": { + "effect": { + "type": "String", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + }, + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists" + }, + "privateDnsZoneId": { + "type": "String", + "metadata": { + "displayName": "Configure a private DNS Zone ID for sqlServer groupID", + "description": "Configure private DNS zone group to override the DNS resolution for a sqlServer groupID private endpoint.", + "strongType": "Microsoft.Network/privateDnsZones", + "assignPermissions": true + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Network/privateEndpoints" + }, + { + "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].privateLinkServiceId", + "contains": "Microsoft.Sql/servers" + }, + { + "count": { + "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].groupIds[*]", + "where": { + "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].groupIds[*]", + "equals": "sqlServer" + } + }, + "greaterOrEquals": 1 + } + ] + }, + "then": { + "effect": "[[parameters('effect')]", + "details": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "roleDefinitionIds": [ + "/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7" + ], + "existenceCondition": { + "allOf": [ + { + "field": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/privateDnsZoneConfigs[*].privateDnsZoneId", + "equals": "[[parameters('privateDnsZoneId')]" + } + ] + }, + "deployment": { + "properties": { + "mode": "incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "privateDnsZoneId": { + "type": "string" + }, + "privateEndpointName": { + "type": "string" + }, + "location": { + "type": "string" + } + }, + "resources": [ + { + "name": "[[concat(parameters('privateEndpointName'), '/deployedByPolicy')]", + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2020-03-01", + "location": "[[parameters('location')]", + "properties": { + "privateDnsZoneConfigs": [ + { + "name": "privateDnsZone", + "properties": { + "privateDnsZoneId": "[[parameters('privateDnsZoneId')]" + } + } + ] + } + } + ] + }, + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('privateDnsZoneId')]" + }, + "privateEndpointName": { + "value": "[[field('name')]" + }, + "location": { + "value": "[[field('location')]" + } + } + } + } + } + } + } + }, + "name": "DINE-SQL-Dns" + } ] } }, @@ -333,10 +458,33 @@ "avdWorkspacePrivateEndpointGroupId": { "type": "string", "defaultValue": "feed" + }, + "sqlPrivateDnsZone": { + "type": "string", + "defaultValue": "DeployIfNotExists" + }, + "sqlPrivateDnsZoneId": { + "type": "string", + "defaultValue": "" } }, "policyDefinitions": [ - { + { + "policyDefinitionId": "[concat(variables('scope'), '/providers/Microsoft.Authorization/policyDefinitions/', variables('policies').policyDefinitions[0].name)]", + "policyDefinitionReferenceId": "DINE-SQL-Dns", + "groupNames": [ + "Network" + ], + "parameters": { + "effect": { + "value": "[[parameters('sqlPrivateDnsZone')]" + }, + "privateDnsZoneId": { + "value": "[[parameters('sqlPrivateDnsZoneId')]" + } + } + }, + { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/34804460-d88b-4922-a7ca-537165e060ed", "policyDefinitionReferenceId": "Dine-Workspace-DNS-Zone", "groupNames": [ From dd712a25b4e7a9f8fca47623b68816b48bcaab8c Mon Sep 17 00:00:00 2001 From: Marvin Buss Date: Sat, 4 Mar 2023 14:44:14 +0100 Subject: [PATCH 2/2] Update MG name --- .../policyDefinitions/Compliant-CorpLzPolicySetDefinition.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/foundations/azure/referenceImplementations/core/managementGroupTemplates/policyDefinitions/Compliant-CorpLzPolicySetDefinition.json b/foundations/azure/referenceImplementations/core/managementGroupTemplates/policyDefinitions/Compliant-CorpLzPolicySetDefinition.json index 8b2b810a..00269b88 100644 --- a/foundations/azure/referenceImplementations/core/managementGroupTemplates/policyDefinitions/Compliant-CorpLzPolicySetDefinition.json +++ b/foundations/azure/referenceImplementations/core/managementGroupTemplates/policyDefinitions/Compliant-CorpLzPolicySetDefinition.json @@ -4,7 +4,7 @@ "parameters": { "topLevelManagementGroupPrefix": { "type": "string", - "defaultValue": "test" + "defaultValue": "FSIDemo" } }, "variables": {