config/profiles/hardened.json
|
{ "profileName": "hardened", "description": "Hardened Azure demo environment deploying all resource types with CIS v5.0.0/MCSB-aligned security controls. HTTPS-only, TLS 1.2, no public IPs on VMs, Defender for Cloud + Sentinel enabled, RBAC-based auth, private networking, policy enforcement mode Default. Use to test the effectiveness of security controls and benchmark improvements over the default (unhardened) profile.", "version": "2.0.0", "modules": { "monitoring": { "enabled": true, "features": { "alertRules": true, "alertEmail": "" } }, "networking": { "enabled": true, "features": { "bastionSku": "Standard", "enableAppGateway": false, "enableFirewall": "None", "enableVpnGateway": false, "enableDdos": false, "enableNatGateway": false, "enablePrivateDnsZones": true } }, "security": { "enabled": true, "features": { "keyVault": true, "managedIdentity": true, "defenderForCloud": true, "sentinel": true, "allowedCidrRanges": [] } }, "compute": { "enabled": true, "features": { "windowsVm": true, "linuxVm": true, "vmss": false, "enableAutoShutdown": true, "vmSku": "Standard_B2s", "domainController": false, "domainName": "" } }, "storage": { "enabled": true, "features": { "dataLakeGen2": true, "enableSoftDelete": true, "enableVersioning": true, "allowedCidrRanges": [] } }, "databases": { "enabled": true, "features": { "sqlDatabase": true, "cosmosDb": true, "postgresql": false, "mysql": false, "redis": false, "sqlVm": false } }, "appservices": { "enabled": true, "features": { "windowsWebApp": true, "functionApp": true, "logicApp": true } }, "containers": { "enabled": true, "features": { "containerRegistry": true, "kubernetesService": true, "containerApps": true, "containerInstances": true, "aksAuthorizedIpRanges": [] } }, "integration": { "enabled": true, "features": { "serviceBus": true, "eventHub": true, "eventGrid": true, "signalR": true, "apiManagement": false, "apimSku": "Developer" } }, "ai": { "enabled": false, "features": { "aiServices": false, "openAi": false, "cognitiveSearch": false, "machineLearning": false } }, "data": { "enabled": false, "features": { "dataFactory": false, "synapse": false, "databricks": false, "purview": false } }, "governance": { "enabled": true, "features": { "automationAccount": true, "budget": true, "budgetAmount": 400, "resourceLocks": true, "policyAssignments": true, "budgetAlertEmail": "" } } }, "seedDummyData": false } |