Framework/Configurations/SubscriptionSecurity/Subscription.ARMPolicies.json

{
   "Version": "2.1801.0",
   "Policies": [
      {
         "policyDefinitionName": "AzSDK_ARMPol_Audit_SQL_Basic_Create",
         "policyDefinition": "{\"if\":{\"field\":\"Microsoft.SQL/servers/databases/edition\",\"equals\":\"Basic\"},\"then\":{\"effect\":\"audit\"}}",
         "description": "Policy to generate an audit event upon creation of a SQL database with 'Basic' edition type",
         "tags": [
            "Mandatory"
         ],
         "enabled": true,
         "scope": "/subscriptions/$subscriptionId"
      },
      {
         "policyDefinitionName": "AzSDK_ARMPol_Audit_NonGRS_Storage_SKU",
         "policyDefinition": "{\"if\":{\"allOf\":[{\"field\":\"type\",\"equals\":\"Microsoft.Storage/storageAccounts\"},{\"field\":\"Microsoft.Storage/storageAccounts/sku.name\",\"equals\":\"Standard_LRS\"}]},\"then\":{\"effect\":\"audit\"}}",
         "description": "Policy to generate an audit event upon creation of a storage account with Standard LRS (no Geo-Replication)",
         "tags": [
            "Mandatory"
         ],
         "enabled": true,
         "scope": "/subscriptions/$subscriptionId"
      },
      {
         "policyDefinitionName": "AzSDK_ARMPol_Audit_Job_Scheduler_Free_Tier",
         "policyDefinition": "{\"if\":{\"allOf\":[{\"field\":\"type\",\"equals\":\"Microsoft.Scheduler/jobcollections\"},{\"field\":\"Microsoft.Scheduler/jobcollections/sku.name\",\"equals\":\"Free\"}]},\"then\":{\"effect\":\"audit\"}}",
         "description": "Policy to generate an audit event upon creation of a job scheduler with free tier",
         "tags": [
            "Mandatory"
         ],
         "enabled": true,
         "scope": "/subscriptions/$subscriptionId"
      },
      {
         "policyDefinitionName": "AzSDK_ARMPol_Audit_Old_SQL_Version",
         "policyDefinition": "{\"if\":{\"allOf\":[{\"field\":\"type\",\"equals\":\"Microsoft.SQL/servers\"},{\"field\":\"Microsoft.SQL/servers/version\",\"in\":[\"2.0\",\"3.0\",\"4.0\",\"5.0\",\"6.0\",\"7.0\",\"8.0\",\"9.0\",\"10.0\",\"11.0\"]}]},\"then\":{\"effect\":\"audit\"}}",
         "description": "Policy to generate an audit event upon creation of a sql server with version less than 12.0",
         "tags": [
            "Mandatory"
         ],
         "enabled": true,
         "scope": "/subscriptions/$subscriptionId"
      },
      {
         "policyDefinitionName": "AzSDK_ARMPol_Audit_NonHBI_Resource_Create",
         "policyDefinition": "{\"if\":{\"not\":{\"anyOf\":[{\"field\":\"type\",\"like\":\"Microsoft.DataFactory/*\"},{\"field\":\"type\",\"like\":\"Microsoft.DataLakeAnalytics/*\"},{\"field\":\"type\",\"like\":\"Microsoft.DataLakeStore/*\"},{\"field\":\"type\",\"like\":\"Microsoft.Web/*\"},{\"field\":\"type\",\"like\":\"Microsoft.Search/*\"},{\"field\":\"type\",\"like\":\"Microsoft.ServiceBus/*\"},{\"field\":\"type\",\"like\":\"Microsoft.Relay/*\"},{\"field\":\"type\",\"like\":\"Microsoft.EventHub/*\"},{\"field\":\"type\",\"like\":\"Microsoft.Logic/*\"},{\"field\":\"type\",\"like\":\"Microsoft.NotificationHubs/*\"},{\"field\":\"type\",\"like\":\"Microsoft.ServiceFabric/*\"},{\"field\":\"type\",\"like\":\"Microsoft.Sql/*\"},{\"field\":\"type\",\"like\":\"Microsoft.Compute/*\"},{\"field\":\"type\",\"like\":\"Microsoft.Storage/*\"},{\"field\":\"type\",\"like\":\"Microsoft.AnalysisServices/*\"},{\"field\":\"type\",\"like\":\"Microsoft.Automation/*\"},{\"field\":\"type\",\"like\":\"Microsoft.Cdn/*\"},{\"field\":\"type\",\"like\":\"Microsoft.DocumentDb/*\"},{\"field\":\"type\",\"like\":\"Microsoft.Network/*\"},{\"field\":\"type\",\"like\":\"Microsoft.KeyVault/*\"},{\"field\":\"type\",\"like\":\"Microsoft.Cache/*\"},{\"field\":\"type\",\"like\":\"Microsoft.StreamAnalytics/*\"},{\"field\":\"type\",\"like\":\"Microsoft.Compute/*\"}]}},\"then\":{\"effect\":\"audit\"}}",
         "description": "Policy to generate an audit event upon creation of resource types which have not been ratified for critical enterprise data",
         "tags": [
            "Mandatory"
         ],
         "enabled": true,
         "scope": "/subscriptions/$subscriptionId"
      },
      {
         "policyDefinitionName": "AzSDK_ARMPol_Audit_Classic_Resource_Create",
         "policyDefinition": "{\"if\":{\"anyOf\":[{\"field\":\"type\",\"like\":\"Microsoft.ClassicCompute/*\"},{\"field\":\"type\",\"like\":\"microsoft.classicStorage/*\"},{\"field\":\"type\",\"like\":\"Microsoft.ClassicNetwork/*\"},{\"field\": \"type\",\"like\": \"Microsoft.Backup/*\"}]},\"then\":{\"effect\":\"audit\"}}",
         "description": "Policy to generate an audit event upon creation of classic/v1 (i.e., ASM-based) resources",
         "tags": [
            "Mandatory"
         ],
         "enabled": true,
         "scope": "/subscriptions/$subscriptionId"
      },
      {
         "policyDefinitionName": "AzSDK_ARMPol_Deny_Classic_Resource_Create",
         "policyDefinition": "{\"if\":{\"anyOf\":[{\"field\":\"type\",\"like\":\"Microsoft.ClassicCompute/*\"},{\"field\":\"type\",\"like\":\"microsoft.classicStorage/*\"},{\"field\":\"type\",\"like\":\"Microsoft.ClassicNetwork/*\"}]},\"then\":{\"effect\":\"deny\"}}",
         "description": "Policy to deny upon creation of classic/v1 (i.e., ASM-based) resources",
         "tags": [
            "Mandatory"
         ],
         "enabled": true,
         "scope": "/subscriptions/$subscriptionId"
      }
   ]
 
}