Framework/Configurations/SVT/Services/TrafficManager.json

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
{
  "FeatureName": "TrafficManager",
  "Reference": "aka.ms/azsktcp/trafficmanager",
  "IsManintenanceMode": false,
  "Controls": [
    {
      "ControlID": "Azure_TrafficManager_AuthZ_Grant_Min_RBAC_Access",
      "Description": "All Users/Identities must be granted minimum required permissions using Role Based Access Control (RBAC)",
      "Id": "TrafficManager110",
      "ControlSeverity": "Medium",
      "Automated": "Yes",
      "MethodName": "CheckRBACAccess",
      "Rationale": "Granting minimum access by leveraging RBAC feature ensures that users are granted just enough permissions to perform their tasks. This minimizes exposure of the resources in case of user/service account compromise.",
      "Recommendation": "Clean up any unauthorized users on the Traffic Manager Profile. Run command Remove-AzureRmRoleAssignment -SignInName '{signInName}' -Scope '{scope}}' -RoleDefinitionName {role definition name}'. Run 'Get-Help Remove-AzureRmRoleAssignment -full' to get the complete details about this command.",
      "Tags": [
        "SDL",
        "TCP",
        "Automated",
        "AuthZ",
        "RBAC"
      ],
      "Enabled": true
    },
    {
      "ControlID": "Azure_TrafficManager_DP_Enable_HTTPS",
      "Description": "Traffic Manager profile should use HTTPS protocol for endpoint monitoring",
      "Id": "TrafficManager120",
      "ControlSeverity": "Medium",
      "Automated": "Yes",
      "MethodName": "CheckTrafficManagerEndpointMonitorProtocol",
      "Rationale": "Use of HTTPS ensures server/service authentication and protects data in transit from network layer man-in-the-middle, eavesdropping, session-hijacking attacks.",
      "Recommendation": "To enable HTTPS protocol for endpoint monitoring, go to Azure Portal --> your Traffic Manager Profile --> Configuration --> Select HTTPS --> Save. Else implement through PowerShell as follows: `$tp = Get-AzureRmTrafficManagerProfile -Name <profile Name> -ResourceGroupName <RGName>; `$tp.MonitorProtocol = 'HTTPS'; `$tp.MonitorPath=<MonitorPath>; Set-AzureRmTrafficManagerProfile -TrafficManagerProfile `$tp",
      "Tags": [
        "SDL",
        "Best Practice",
        "Automated",
        "DP"
      ],
      "Enabled": true,
      "FixControl": {
         "FixMethodName": "EnableHttpsAsMonitorProtocol",
         "FixControlImpact": "Medium"
      }
    }
  ]
}