Framework/Configurations/SVT/Services/RedisCache.json
|
{
"FeatureName": "RedisCache", "Reference": "aka.ms/azsdkosstcp", "IsManintenanceMode": false, "Controls": [ { "ControlID": "Azure_RedisCache_AuthZ_Grant_Min_RBAC_Access", "Description": "All users/identities must be granted minimum required permissions using Role Based Access Control (RBAC)", "Id": "RedisCache110", "ControlSeverity": "Medium", "Automated": "Yes", "MethodName": "CheckRBACAccess", "Recommendation": "Remove any excessive privileges granted on the Redis Cache. Assign 'Redis Cache Contributor' RBAC role to developers who manages Redis Cache configurations. Run command: Remove-AzureRmRoleAssignment -SignInName '{signInName}' -Scope '{scope}' -RoleDefinitionName '{role definition name}'. Run 'Get-Help Remove-AzureRmRoleAssignment -full' for more help. Refer: https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-manage-access-powershell", "Tags": [ "SDL", "TCP", "Automated", "AuthZ", "RBAC" ], "Enabled": true }, { "ControlID": "Azure_RedisCache_Audit_Enable_Diagnostics_Log", "Description": "Diagnostics logs must be enabled with a retention period of at least $($this.ControlSettings.Diagnostics_RetentionPeriod_Min) days.", "Id": "RedisCache120", "ControlSeverity": "Medium", "Automated": "No", "MethodName": "", "Recommendation": "Diagnostics logs must be enabled with a retention period of at least $($this.ControlSettings.Diagnostics_RetentionPeriod_Min) days. Run command Set-AzureRmDiagnosticSetting -ResourceId {'ResourceId'} -Enable $true -StorageAccountId '{StorageAccountId}' -RetentionInDays $($this.ControlSettings.Diagnostics_RetentionPeriod_Min) -RetentionEnabled $true. Refer: https://docs.microsoft.com/en-us/azure/redis-cache/cache-how-to-monitor#enable-cache-diagnostics", "Tags": [ "SDL", "TCP", "Manual", "Audit", "Diagnostics" ], "Enabled": true }, { "ControlID": "Azure_RedisCache_AuthZ_Configure_IP_Range", "Description": "Configure Redis Cache firewall settings for additional protection", "Id": "RedisCache130", "ControlSeverity": "Medium", "Automated": "Yes", "MethodName": "CheckRedisCacheFirewallIPAddressRange", "Recommendation": "Enable firewall and add rules specifying permitted IPs/ranges. Do not add IP range $($this.ControlSettings.UniversalIPRange) as that allows access to all possible IPs. Refer: https://docs.microsoft.com/en-us/azure/redis-cache/cache-configure#firewall, (REST API) https://docs.microsoft.com/en-in/rest/api/redis/redisfirewallrule", "Tags": [ "SDL", "Best Practice", "Automated", "AuthZ" ], "Enabled": true }, { "ControlID": "Azure_RedisCache_BCDR_Use_RDB_Backup", "Description": "Redis Data Persistence should be enabled to back up Redis Cache data", "Id": "RedisCache140", "ControlSeverity": "Medium", "Automated": "Yes", "MethodName": "CheckRedisCacheRDBBackup", "Recommendation": "Configure data persistence. Refer: https://docs.microsoft.com/en-us/azure/redis-cache/cache-configure#redis-data-persistence", "Tags": [ "SDL", "Best Practice", "Automated", "BCDR", "OwnerAccess" ], "Enabled": true }, { "ControlID": "Azure_RedisCache_DP_Use_SSL_Port", "Description": "Non-SSL port must not be enabled", "Id": "RedisCache150", "ControlSeverity": "High", "Automated": "Yes", "MethodName": "CheckRedisCacheSSLConfig", "Recommendation": "To disable Non-SSL port for Redis Cache, go to Azure Portal -> Redis Cache -> <Select your Redis Cache> -> Advanced Settings -> Allow access only via SSL -> Select 'Yes'.", "Tags": [ "SDL", "TCP", "Automated", "DP" ], "Enabled": true }, { "ControlID": "Azure_RedisCache_DP_Rotate_Keys", "Description": "Access keys must be rotated periodically", "Id": "RedisCache160", "ControlSeverity": "Medium", "Automated": "No", "MethodName": "", "Recommendation": "Rotate keys at regular intervals. To generate a new key, run command 'New-AzureRmRedisCacheKey'. Run 'Get-Help New-AzureRmRedisCacheKey -full' for more help.", "Tags": [ "SDL", "TCP", "Manual", "DP" ], "Enabled": true }, { "ControlID": "Azure_RedisCache_AuthN_Dont_Share_Cache_Instances", "Description": "Do not share cache instances across applications", "Id": "RedisCache170", "ControlSeverity": "High", "Automated": "No", "MethodName": "", "Recommendation": "Create a separate Redis Cache instance for each application. Refer: https://docs.microsoft.com/en-us/azure/redis-cache/cache-web-app-howto#configure-the-application-to-use-redis-cache", "Tags": [ "SDL", "TCP", "Manual", "AuthN" ], "Enabled": true }, { "ControlID": "Azure_RedisCache_NetSec_Configure_Virtual_Network_For_Domain_App", "Description": "Redis Cache instance should be confined within a virtual network for domain-joined scenarios", "Id": "RedisCache180", "ControlSeverity": "Medium", "Automated": "No", "MethodName": "", "Recommendation": "For steps to configure Azure Redis Cache on a Virtual Network, refer: https://docs.microsoft.com/en-us/azure/redis-cache/cache-how-to-premium-vnet", "Tags": [ "SDL", "TCP", "Manual", "NetSec" ], "Enabled": true } ] } |