output/20260723_081532/govviz/ALZ_20260723_081601/Enterprise-Scale/src/resources/Microsoft.Authorization/policySetDefinitions/Enforce-Guardrails-Storage.json
|
{ "name": "Enforce-Guardrails-Storage", "type": "Microsoft.Authorization/policySetDefinitions", "apiVersion": "2023-04-01", "scope": null, "properties": { "policyType": "Custom", "displayName": "Enforce recommended guardrails for Storage Account", "description": "This policy initiative is a group of policies that ensures Storage is compliant per regulated Landing Zones.", "metadata": { "version": "1.1.0", "category": "Storage", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ "AzureCloud", "AzureChinaCloud", "AzureUSGovernment" ] }, "parameters": { "storageKeysExpiration": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageAccountNetworkRules": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageAccountRestrictNetworkRules": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageThreatProtection": { "type": "string", "defaultValue": "DeployIfNotExists", "allowedValues": [ "DeployIfNotExists", "Disabled" ] }, "storageClassicToArm": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageAccountsInfraEncryption": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageAccountSharedKey": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageAccountsCrossTenant": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageAccountsDoubleEncryption": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageAccountsCopyScope": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageAccountsAllowedCopyScope": { "type": "string", "defaultValue": "AAD" }, "storageServicesEncryption": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageLocalUser": { "type": "string", "defaultValue": "Disabled", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageSftp": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageNetworkAclsBypass": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageAllowedNetworkAclsBypass": { "type": "array", "defaultValue": [ "None" ] }, "storageResourceAccessRulesTenantId": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageResourceAccessRulesResourceId": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageNetworkAclsVirtualNetworkRules": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageContainerDeleteRetentionPolicy": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "storageMinContainerDeleteRetentionInDays": { "type": "Integer", "defaultValue": 7 }, "storageCorsRules": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "modifyStorageFileSyncPublicEndpoint": { "type": "string", "defaultValue": "Modify", "allowedValues": [ "Modify", "Disabled" ] }, "modifyStorageAccountPublicEndpoint": { "type": "string", "defaultValue": "Modify", "allowedValues": [ "Modify", "Disabled" ] }, "storageAccountsModifyDisablePublicNetworkAccess": { "type": "string", "defaultValue": "Modify", "allowedValues": [ "Modify", "Disabled" ] } }, "policyDefinitions": [ { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-CopyScope", "policyDefinitionReferenceId": "Deny-Storage-CopyScope", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageAccountsCopyScope')]" }, "allowedCopyScope": { "value": "[[parameters('storageAccountsAllowedCopyScope')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-ServicesEncryption", "policyDefinitionReferenceId": "Deny-Storage-ServicesEncryption", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageServicesEncryption')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-LocalUser", "policyDefinitionReferenceId": "Deny-Storage-LocalUser", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageLocalUser')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-SFTP", "policyDefinitionReferenceId": "Deny-Storage-SFTP", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageSftp')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-NetworkAclsBypass", "policyDefinitionReferenceId": "Deny-Storage-NetworkAclsBypass", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageNetworkAclsBypass')]" }, "allowedBypassOptions": { "value": "[[parameters('storageAllowedNetworkAclsBypass')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-ResourceAccessRulesTenantId", "policyDefinitionReferenceId": "Deny-Storage-ResourceAccessRulesTenantId", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageResourceAccessRulesTenantId')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-ResourceAccessRulesResourceId", "policyDefinitionReferenceId": "Deny-Storage-ResourceAccessRulesResourceId", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageResourceAccessRulesResourceId')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-NetworkAclsVirtualNetworkRules", "policyDefinitionReferenceId": "Deny-Storage-NetworkAclsVirtualNetworkRules", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageNetworkAclsVirtualNetworkRules')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-ContainerDeleteRetentionPolicy", "policyDefinitionReferenceId": "Deny-Storage-ContainerDeleteRetentionPolicy", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageContainerDeleteRetentionPolicy')]" }, "minContainerDeleteRetentionInDays": { "value": "[[parameters('storageMinContainerDeleteRetentionInDays')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-CorsRules", "policyDefinitionReferenceId": "Deny-Storage-CorsRules", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageCorsRules')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/bfecdea6-31c4-4045-ad42-71b9dc87247d", "policyDefinitionReferenceId": "Deny-Storage-Account-Encryption", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageAccountsDoubleEncryption')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/92a89a79-6c52-4a7e-a03f-61306fc49312", "policyDefinitionReferenceId": "Deny-Storage-Cross-Tenant", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageAccountsCrossTenant')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54", "policyDefinitionReferenceId": "Deny-Storage-Shared-Key", "definitionVersion": "2.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageAccountSharedKey')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4733ea7b-a883-42fe-8cac-97454c2a9e4a", "policyDefinitionReferenceId": "Deny-Storage-Infra-Encryption", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageAccountsInfraEncryption')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/37e0d2fe-28a5-43d6-a273-67d37d1f5606", "policyDefinitionReferenceId": "Deny-Storage-Classic", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageClassicToArm')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/361c2074-3595-4e5d-8cab-4f21dffc835c", "policyDefinitionReferenceId": "Dine-Storage-Threat-Protection", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageThreatProtection')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/34c877ad-507e-4c82-993e-3452a6e0ad3c", "policyDefinitionReferenceId": "Deny-Storage-Restrict-NetworkRules", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageAccountRestrictNetworkRules')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2a1a9cdf-e04d-429a-8416-3bfb72a1b26f", "policyDefinitionReferenceId": "Deny-Storage-NetworkRules", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageAccountNetworkRules')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/044985bb-afe1-42cd-8a36-9d5d42424537", "policyDefinitionReferenceId": "Deny-Storage-Account-Keys-Expire", "definitionVersion": "3.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageKeysExpiration')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0e07b2e9-6cd9-4c40-9ccb-52817b95133b", "policyDefinitionReferenceId": "Modify-Storage-FileSync-PublicEndpoint", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('modifyStorageFileSyncPublicEndpoint')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/13502221-8df0-4414-9937-de9c5c4e396b", "policyDefinitionReferenceId": "Modify-Blob-Storage-Account-PublicEndpoint", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('modifyStorageAccountPublicEndpoint')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a06d0189-92e8-4dba-b0c4-08d7669fce7d", "policyDefinitionReferenceId": "Modify-Storage-Account-PublicEndpoint", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('storageAccountsModifyDisablePublicNetworkAccess')]" } } } ], "policyDefinitionGroups": null } } |