output/20260723_081532/govviz/ALZ_20260723_081601/Enterprise-Scale/src/resources/Microsoft.Authorization/policySetDefinitions/Enforce-Guardrails-APIM.json
|
{ "name": "Enforce-Guardrails-APIM", "type": "Microsoft.Authorization/policySetDefinitions", "apiVersion": "2023-04-01", "scope": null, "properties": { "policyType": "Custom", "displayName": "Enforce recommended guardrails for API Management", "description": "This policy initiative is a group of policies that ensures API Management is compliant per regulated Landing Zones.", "metadata": { "version": "1.1.0", "category": "API Management", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ "AzureCloud", "AzureChinaCloud", "AzureUSGovernment" ] }, "parameters": { "apiSubscriptionScope": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "minimumApiVersion": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "apimSkuVnet": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "apimDisablePublicNetworkAccess": { "type": "string", "defaultValue": "DeployIfNotExists", "allowedValues": [ "DeployIfNotExists", "Disabled" ] }, "apimApiBackendCertValidation": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "apimDirectApiEndpoint": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "apimCallApiAuthn": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "apimEncryptedProtocols": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "apimVnetUsage": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "apimSecrets": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "apimTls": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] } }, "policyDefinitions": [ { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f1cc7827-022c-473e-836e-5a51cae0b249", "policyDefinitionReferenceId": "Deny-Apim-without-Kv", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('apimSecrets')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ef619a2c-cc4d-4d03-b2ba-8c94a834d85b", "policyDefinitionReferenceId": "Deny-Apim-without-Vnet", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('apimVnetUsage')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-APIM-TLS", "policyDefinitionReferenceId": "Deny-APIM-TLS", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('apimTls')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ee7495e7-3ba7-40b6-bfee-c29e22cc75d4", "policyDefinitionReferenceId": "Deny-Apim-Protocols", "definitionVersion": "2.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('apimEncryptedProtocols')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c15dcc82-b93c-4dcb-9332-fbf121685b54", "policyDefinitionReferenceId": "Deny-Apim-Authn", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('apimCallApiAuthn')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b741306c-968e-4b67-b916-5675e5c709f4", "policyDefinitionReferenceId": "Deny-Apim-Direct-Endpoint", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('apimDirectApiEndpoint')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/92bb331d-ac71-416a-8c91-02f2cb734ce4", "policyDefinitionReferenceId": "Deny-Apim-Cert-Validation", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('apimApiBackendCertValidation')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7ca8c8ac-3a6e-493d-99ba-c5fa35347ff2", "policyDefinitionReferenceId": "Dine-Apim-Public-NetworkAccess", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('apimDisablePublicNetworkAccess')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/73ef9241-5d81-4cd4-b483-8443d1730fe5", "policyDefinitionReferenceId": "Deny-Apim-Sku-Vnet", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('apimSkuVnet')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/549814b6-3212-4203-bdc8-1548d342fb67", "policyDefinitionReferenceId": "Deny-Apim-Version", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('minimumApiVersion')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3aa03346-d8c5-4994-a5bc-7652c2a2aef1", "policyDefinitionReferenceId": "Deny-Api-subscription-scope", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('apiSubscriptionScope')]" } } } ], "policyDefinitionGroups": null } } |