output/20260723_081532/govviz/ALZ_20260723_081601/Enterprise-Scale/src/resources/Microsoft.Authorization/policySetDefinitions/Enforce-Guardrails-Kubernetes.json
|
{ "name": "Enforce-Guardrails-Kubernetes", "type": "Microsoft.Authorization/policySetDefinitions", "apiVersion": "2023-04-01", "scope": null, "properties": { "policyType": "Custom", "displayName": "Enforce recommended guardrails for Kubernetes", "description": "This policy initiative is a group of policies that ensures Kubernetes is compliant per regulated Landing Zones.", "metadata": { "version": "2.0.0", "category": "Kubernetes", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ "AzureCloud", "AzureChinaCloud", "AzureUSGovernment" ] }, "parameters": { "aksKms": { "type": "string", "defaultValue": "Audit", "allowedValues": [ "Audit", "Disabled" ] }, "aksCni": { "type": "string", "defaultValue": "Audit", "allowedValues": [ "Audit", "Disabled" ] }, "aksLocalAuth": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "aksPrivateCluster": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "aksPolicy": { "type": "string", "defaultValue": "DeployIfNotExists", "allowedValues": [ "DeployIfNotExists", "Disabled" ] }, "aksCommandInvoke": { "type": "string", "defaultValue": "DeployIfNotExists", "allowedValues": [ "DeployIfNotExists", "Disabled" ] }, "aksReadinessOrLivenessProbes": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "aksPrivContainers": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "audit", "Audit", "deny", "Deny", "disabled", "Disabled" ] }, "aksPrivEscalation": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "audit", "Audit", "deny", "Deny", "disabled", "Disabled" ] }, "aksAllowedCapabilities": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "audit", "Audit", "deny", "Deny", "disabled", "Disabled" ] }, "aksTempDisk": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "aksInternalLb": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "audit", "Audit", "deny", "Deny", "disabled", "Disabled" ] }, "aksDefaultNamespace": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "audit", "Audit", "deny", "Deny", "disabled", "Disabled" ] }, "aksNakedPods": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "aksShareHostProcessAndNamespace": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "audit", "Audit", "deny", "Deny", "disabled", "Disabled" ] }, "aksWindowsContainerAdministrator": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "aksKubenetEffect": { "type": "string", "defaultValue": "Audit", "allowedValues": [ "Audit", "Deny", "Disabled" ] } }, "policyDefinitions": [ { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5485eac0-7e8f-4964-998b-a44f4f0c1e75", "policyDefinitionReferenceId": "Deny-Aks-Windows-Container-Administrator", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksWindowsContainerAdministrator')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/47a1ee2f-2a2a-4576-bf2a-e0e36709c2b8", "policyDefinitionReferenceId": "Deny-Aks-Shared-Host-Process-Namespace", "definitionVersion": "5.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksShareHostProcessAndNamespace')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/65280eef-c8b4-425e-9aec-af55e55bf581", "policyDefinitionReferenceId": "Deny-Aks-Naked-Pods", "definitionVersion": "2.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksNakedPods')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9f061a12-e40d-4183-a00e-171812443373", "policyDefinitionReferenceId": "Deny-Aks-Default-Namespace", "definitionVersion": "4.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksDefaultNamespace')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3fc4dc25-5baf-40d8-9b05-7fe74c1bc64e", "policyDefinitionReferenceId": "Deny-Aks-Internal-Lb", "definitionVersion": "8.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksInternalLb')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/41425d9f-d1a5-499a-9932-f8ed8453932c", "policyDefinitionReferenceId": "Deny-Aks-Temp-Disk-Encryption", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksTempDisk')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c26596ff-4d70-4e6a-9a30-c2506bd2f80c", "policyDefinitionReferenceId": "Deny-Aks-Allowed-Capabilities", "definitionVersion": "6.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksAllowedCapabilities')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1c6e92c9-99f0-4e55-9cf2-0c234dc48f99", "policyDefinitionReferenceId": "Deny-Aks-Priv-Escalation", "definitionVersion": "7.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksPrivEscalation')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/95edb821-ddaf-4404-9732-666045e056b4", "policyDefinitionReferenceId": "Deny-Aks-Priv-Containers", "definitionVersion": "9.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksPrivContainers')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b1a9997f-2883-4f12-bdff-2280f99b5915", "policyDefinitionReferenceId": "Deny-Aks-ReadinessOrLiveness-Probes", "definitionVersion": "3.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksReadinessOrLivenessProbes')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1b708b0a-3380-40e9-8b79-821f9fa224cc", "policyDefinitionReferenceId": "Dine-Aks-Command-Invoke", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksCommandInvoke')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a8eff44f-8c92-45c3-a3fb-9880802d67a7", "policyDefinitionReferenceId": "Dine-Aks-Policy", "definitionVersion": "4.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksPolicy')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/040732e8-d947-40b8-95d6-854c95024bf8", "policyDefinitionReferenceId": "Deny-Aks-Private-Cluster", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksPrivateCluster')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/993c2fcd-2b29-49d2-9eb0-df2c3a730c32", "policyDefinitionReferenceId": "Deny-Aks-Local-Auth", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksLocalAuth')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/dbbdc317-9734-4dd8-9074-993b29c69008", "policyDefinitionReferenceId": "Deny-Aks-Kms", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksKms')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/46238e2f-3f6f-4589-9f3f-77bed4116e67", "policyDefinitionReferenceId": "Deny-Aks-Cni", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksCni')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Audit-AKS-kubenet", "policyDefinitionReferenceId": "Audit-AKS-Kubenet", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('aksKubenetEffect')]" } } } ], "policyDefinitionGroups": null } } |