PSRule.Rules.Azure

1.18.0

rules/Azure.VM.Rule.ps1

                                # Copyright (c) Microsoft Corporation.

# Licensed under the MIT License.

#

# Validation rules for Azure Virtual Machines

#

#region Virtual machine

# Synopsis: Virtual machines should use managed disks

Rule 'Azure.VM.UseManagedDisks' -Ref 'AZR-000238' -Type 'Microsoft.Compute/virtualMachines' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    # Check OS disk

    $Assert.

        NullOrEmpty($TargetObject, 'properties.storageProfile.osDisk.vhd.uri').

        WithReason(($LocalizedData.UnmanagedDisk -f $TargetObject.properties.storageProfile.osDisk.name), $True);

    # Check data disks

    foreach ($dataDisk in $TargetObject.properties.storageProfile.dataDisks) {

        $Assert.

            NullOrEmpty($dataDisk, 'vhd.uri').

            WithReason(($LocalizedData.UnmanagedDisk -f $dataDisk.name), $True);

    }

}

# Synopsis: VMs should not use expired promo SKU

Rule 'Azure.VM.PromoSku' -Ref 'AZR-000240' -If { IsVMPromoSku } -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    Match 'Properties.hardwareProfile.vmSize' -Not -Expression 'Standard_DS{0,1}1{0,1}[1-9]{1}_v2_Promo'

}

# Synopsis: VMs should not use Basic SKU

Rule 'Azure.VM.BasicSku' -Ref 'AZR-000241' -Type 'Microsoft.Compute/virtualMachines' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    Match 'Properties.hardwareProfile.vmSize' -Not -Expression 'Basic_A[0-4]'

}

# Synopsis: Check disk caching is configured correctly for the workload

Rule 'Azure.VM.DiskCaching' -Ref 'AZR-000242' -Type 'Microsoft.Compute/virtualMachines' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    # Check OS disk

    $Assert.HasFieldValue($TargetObject, 'properties.storageProfile.osDisk.caching', 'ReadWrite');

    # Check data disks

    $dataDisks = @($TargetObject.properties.storageProfile.dataDisks | Where-Object {

        $Null -ne $_

    })

    if ($dataDisks.Length -gt 0) {

        foreach ($disk in $dataDisks) {

            if ($disk.managedDisk.storageAccountType -eq 'Premium_LRS') {

                $Assert.HasFieldValue($disk, 'caching', 'ReadOnly');

            }

            else {

                $Assert.HasFieldValue($disk, 'caching', 'None');

            }

        }

    }

}

# Synopsis: Use Hybrid Use Benefit

Rule 'Azure.VM.UseHybridUseBenefit' -Ref 'AZR-000243' -If { SupportsHybridUse } -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    $Assert.HasFieldValue($TargetObject, 'properties.licenseType', 'Windows_Server');

}

# Synopsis: Enabled accelerated networking for supported operating systems

Rule 'Azure.VM.AcceleratedNetworking' -Ref 'AZR-000244' -If { SupportsAcceleratedNetworking } -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    $networkInterfaces = GetSubResources -ResourceType 'Microsoft.Network/networkInterfaces';

    $Null -ne $networkInterfaces;

    foreach ($interface in $networkInterfaces) {

        $Assert.HasFieldValue($interface, 'Properties.enableAcceleratedNetworking', $True);

    }

}

# Synopsis: Linux VMs should use public key pair

Rule 'Azure.VM.PublicKey' -Ref 'AZR-000245' -If { IsLinuxOS } -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    $Assert.HasFieldValue($TargetObject, 'Properties.osProfile.linuxConfiguration.disablePasswordAuthentication', $True)

}

# Synopsis: Ensure that the VM agent is provisioned automatically

Rule 'Azure.VM.Agent' -Ref 'AZR-000246' -Type 'Microsoft.Compute/virtualMachines' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    $Assert.HasDefaultValue($TargetObject, 'Properties.osProfile.linuxConfiguration.provisionVMAgent', $True)

    $Assert.HasDefaultValue($TargetObject, 'Properties.osProfile.windowsConfiguration.provisionVMAgent', $True)

}

# Synopsis: Ensure automatic updates are enabled at deployment

Rule 'Azure.VM.Updates' -Ref 'AZR-000247' -Type 'Microsoft.Compute/virtualMachines' -If { IsWindowsOS } -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    $Assert.HasDefaultValue($TargetObject, 'Properties.osProfile.windowsConfiguration.enableAutomaticUpdates', $True)

}

# Synopsis: Use VM naming requirements

Rule 'Azure.VM.Name' -Ref 'AZR-000248' -Type 'Microsoft.Compute/virtualMachines' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    # https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftcompute

    # Between 1 and 64 characters long

    $Assert.GreaterOrEqual($TargetObject, 'Name', 1)

    $Assert.LessOrEqual($TargetObject, 'Name', 64)

    # Alphanumerics, underscores, periods, and hyphens

    # Start with alphanumeric

    # End with alphanumeric or underscore

    Match 'Name' '^[A-Za-z0-9]((-|\.)*\w){0,79}$'

}

# Synopsis: Use VM naming requirements

Rule 'Azure.VM.ComputerName' -Ref 'AZR-000249' -Type 'Microsoft.Compute/virtualMachines' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    # https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftcompute

    $maxLength = 64

    $matchExpression = '^[A-Za-z0-9]([A-Za-z0-9-.]){0,63}$'

    if (IsWindowsOS) {

        $maxLength = 15

        # Alphanumeric or hyphens

        # Can not include only numbers

        $matchExpression = '^[A-Za-z0-9-]{0,14}[A-Za-z-][A-Za-z0-9-]{0,14}$'

    }

    # Between 1 and 15/ 64 characters long

    $Assert.GreaterOrEqual($TargetObject, 'Properties.osProfile.computerName', 1)

    $Assert.LessOrEqual($TargetObject, 'Properties.osProfile.computerName', $maxLength)

    # Alphanumerics and hyphens

    # Start and end with alphanumeric

    Match 'Properties.osProfile.computerName' $matchExpression

}

#endregion Virtual machine

#region Managed Disks

# Synopsis: Managed disks should be attached to virtual machines

Rule 'Azure.VM.DiskAttached' -Ref 'AZR-000250' -Type 'Microsoft.Compute/disks' -If { ($TargetObject.ResourceName -notlike '*-ASRReplica') -and (IsExport) } -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    # Disks should be attached unless they are used by ASR, which are not attached until fail over

    # Disks for VMs that are off are marked as Reserved

    Within 'properties.diskState' 'Attached', 'Reserved' -Reason $LocalizedData.ResourceNotAssociated

}

# TODO: Check IOPS

# Synopsis: Managed disk is smaller than SKU size

Rule 'Azure.VM.DiskSizeAlignment' -Ref 'AZR-000251' -Type 'Microsoft.Compute/disks' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    $diskSize = @(32, 64, 128, 256, 512, 1024, 2048, 4096, 8192, 16384, 32768)

    $actualSize = $TargetObject.Properties.diskSizeGB

    # Find the closest disk size

    $i = 0;

    while ($actualSize -gt $diskSize[$i]) {

        $i++;

    }

    # Actual disk size should be the disk size within 5GB

    $Assert.GreaterOrEqual($TargetObject, 'Properties.diskSizeGB', ($diskSize[$i] - 5));

}

# TODO: Check number of disks

# Synopsis: Use Azure Disk Encryption

Rule 'Azure.VM.ADE' -Ref 'AZR-000252' -Type 'Microsoft.Compute/disks' -If { IsExport } -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    $Assert.HasFieldValue($TargetObject, 'Properties.encryptionSettingsCollection.enabled', $True)

    $Assert.HasFieldValue($TargetObject, 'Properties.encryptionSettingsCollection.encryptionSettings')

}

# Synopsis: Use Managed Disk naming requirements

Rule 'Azure.VM.DiskName' -Ref 'AZR-000253' -Type 'Microsoft.Compute/disks' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    # https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftcompute

    # Between 1 and 80 characters long

    $Assert.GreaterOrEqual($TargetObject, 'Name', 1)

    $Assert.LessOrEqual($TargetObject, 'Name', 80)

    # Alphanumerics, underscores, periods, and hyphens

    # Start with alphanumeric

    # End with alphanumeric or underscore

    Match 'Name' '^[A-Za-z0-9]((-|\.)*\w){0,79}$'

}

#endregion Managed Disks

#region Availability set

# Synopsis: Availability sets should be aligned

Rule 'Azure.VM.ASAlignment' -Ref 'AZR-000254' -Type 'Microsoft.Compute/availabilitySets' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    $Assert.HasFieldValue($TargetObject, 'sku.name', 'aligned');

}

# Synopsis: Availability sets should be deployed with at least two members

Rule 'Azure.VM.ASMinMembers' -Ref 'AZR-000255' -Type 'Microsoft.Compute/availabilitySets' -If { IsExport } -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    $Assert.GreaterOrEqual($TargetObject, 'properties.virtualMachines', 2)

}

# Synopsis: Use Availability Set naming requirements

Rule 'Azure.VM.ASName' -Ref 'AZR-000256' -Type 'Microsoft.Compute/availabilitySets' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    # https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftcompute

    # Between 1 and 80 characters long

    $Assert.GreaterOrEqual($TargetObject, 'Name', 1)

    $Assert.LessOrEqual($TargetObject, 'Name', 80)

    # Alphanumerics, underscores, periods, and hyphens

    # Start with alphanumeric

    # End with alphanumeric or underscore

    Match 'Name' '^[A-Za-z0-9]((-|\.)*\w){0,79}$'

}

#endregion Availability set

#region Network Interface

# Synopsis: Network interfaces (NICs) should be attached.

Rule 'Azure.VM.NICAttached' -Ref 'AZR-000257' -Type 'Microsoft.Network/networkInterfaces' -If { IsExport } -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    $Assert.AnyOf(

        $Assert.HasFieldValue($TargetObject, 'Properties.virtualMachine.id'),

        $Assert.HasFieldValue($TargetObject, 'Properties.privateEndpoint.id')

    )

}

# Synopsis: Network interfaces should inherit from virtual network

Rule 'Azure.VM.UniqueDns' -Ref 'AZR-000258' -Type 'Microsoft.Network/networkInterfaces' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    $Assert.NullOrEmpty($TargetObject, 'Properties.dnsSettings.dnsServers')

}

# Synopsis: Use NIC naming requirements

Rule 'Azure.VM.NICName' -Ref 'AZR-000259' -Type 'Microsoft.Network/networkInterfaces' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    # https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftnetwork

    # Between 1 and 80 characters long

    $Assert.GreaterOrEqual($TargetObject, 'Name', 1)

    $Assert.LessOrEqual($TargetObject, 'Name', 80)

    # Alphanumerics, underscores, periods, and hyphens

    # Start with alphanumeric

    # End with alphanumeric or underscore

    Match 'Name' '^[A-Za-z0-9]((-|\.)*\w){0,79}$'

}

#endregion Network Interface

#region Proximity Placement Groups

# Synopsis: Use Proximity Placement Groups naming requirements

Rule 'Azure.VM.PPGName' -Ref 'AZR-000260' -Type 'Microsoft.Compute/proximityPlacementGroups' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    # https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftcompute

    # Between 1 and 80 characters long

    $Assert.GreaterOrEqual($TargetObject, 'Name', 1)

    $Assert.LessOrEqual($TargetObject, 'Name', 80)

    # Alphanumerics, underscores, periods, and hyphens

    # Start and end with alphanumeric

    Match 'Name' '^[A-Za-z0-9]((-|\.|_)*[A-Za-z0-9]){0,79}$'

}

#endregion Proximity Placement Groups

# SIG # Begin signature block

# MIInkwYJKoZIhvcNAQcCoIInhDCCJ4ACAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBLHkyzA/pL4zvY

# nlWKd96226ibchUd0c/zYvvZKnZv36CCDXYwggX0MIID3KADAgECAhMzAAACy7d1

# OfsCcUI2AAAAAALLMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD

# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p

# bmcgUENBIDIwMTEwHhcNMjIwNTEyMjA0NTU5WhcNMjMwNTExMjA0NTU5WjB0MQsw

# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u

# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB

# AQC3sN0WcdGpGXPZIb5iNfFB0xZ8rnJvYnxD6Uf2BHXglpbTEfoe+mO//oLWkRxA

# wppditsSVOD0oglKbtnh9Wp2DARLcxbGaW4YanOWSB1LyLRpHnnQ5POlh2U5trg4

# 3gQjvlNZlQB3lL+zrPtbNvMA7E0Wkmo+Z6YFnsf7aek+KGzaGboAeFO4uKZjQXY5

# RmMzE70Bwaz7hvA05jDURdRKH0i/1yK96TDuP7JyRFLOvA3UXNWz00R9w7ppMDcN

# lXtrmbPigv3xE9FfpfmJRtiOZQKd73K72Wujmj6/Su3+DBTpOq7NgdntW2lJfX3X

# a6oe4F9Pk9xRhkwHsk7Ju9E/AgMBAAGjggFzMIIBbzAfBgNVHSUEGDAWBgorBgEE

# AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUrg/nt/gj+BBLd1jZWYhok7v5/w4w

# RQYDVR0RBD4wPKQ6MDgxHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEW

# MBQGA1UEBRMNMjMwMDEyKzQ3MDUyODAfBgNVHSMEGDAWgBRIbmTlUAXTgqoXNzci

# tW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8vd3d3Lm1pY3Jvc29mdC5j

# b20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3JsMGEG

# CCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQu

# Y29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3J0

# MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIBAJL5t6pVjIRlQ8j4dAFJ

# ZnMke3rRHeQDOPFxswM47HRvgQa2E1jea2aYiMk1WmdqWnYw1bal4IzRlSVf4czf

# zx2vjOIOiaGllW2ByHkfKApngOzJmAQ8F15xSHPRvNMmvpC3PFLvKMf3y5SyPJxh

# 922TTq0q5epJv1SgZDWlUlHL/Ex1nX8kzBRhHvc6D6F5la+oAO4A3o/ZC05OOgm4

# EJxZP9MqUi5iid2dw4Jg/HvtDpCcLj1GLIhCDaebKegajCJlMhhxnDXrGFLJfX8j

# 7k7LUvrZDsQniJZ3D66K+3SZTLhvwK7dMGVFuUUJUfDifrlCTjKG9mxsPDllfyck

# 4zGnRZv8Jw9RgE1zAghnU14L0vVUNOzi/4bE7wIsiRyIcCcVoXRneBA3n/frLXvd

# jDsbb2lpGu78+s1zbO5N0bhHWq4j5WMutrspBxEhqG2PSBjC5Ypi+jhtfu3+x76N

# mBvsyKuxx9+Hm/ALnlzKxr4KyMR3/z4IRMzA1QyppNk65Ui+jB14g+w4vole33M1

# pVqVckrmSebUkmjnCshCiH12IFgHZF7gRwE4YZrJ7QjxZeoZqHaKsQLRMp653beB

# fHfeva9zJPhBSdVcCW7x9q0c2HVPLJHX9YCUU714I+qtLpDGrdbZxD9mikPqL/To

# /1lDZ0ch8FtePhME7houuoPcMIIHejCCBWKgAwIBAgIKYQ6Q0gAAAAAAAzANBgkq

# hkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x

# EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv

# bjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5

# IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEwOTA5WjB+MQswCQYDVQQG

# EwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwG

# A1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYDVQQDEx9NaWNyb3NvZnQg

# Q29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC

# CgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+laUKq4BjgaBEm6f8MMHt03

# a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc6Whe0t+bU7IKLMOv2akr

# rnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4Ddato88tt8zpcoRb0Rrrg

# OGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+lD3v++MrWhAfTVYoonpy

# 4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nkkDstrjNYxbc+/jLTswM9

# sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6A4aN91/w0FK/jJSHvMAh

# dCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmdX4jiJV3TIUs+UsS1Vz8k

# A/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL5zmhD+kjSbwYuER8ReTB

# w3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zdsGbiwZeBe+3W7UvnSSmn

# Eyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3T8HhhUSJxAlMxdSlQy90

# lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS4NaIjAsCAwEAAaOCAe0w

# ggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRIbmTlUAXTgqoXNzcitW2o

# ynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYD

# VR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBDuRQFTuHqp8cx0SOJNDBa

# BgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2Ny

# bC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3JsMF4GCCsG

# AQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3dy5taWNyb3NvZnQuY29t

# L3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3J0MIGfBgNV

# HSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEFBQcCARYzaHR0cDovL3d3

# dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1hcnljcHMuaHRtMEAGCCsG

# AQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkAYwB5AF8AcwB0AGEAdABl

# AG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn8oalmOBUeRou09h0ZyKb

# C5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7v0epo/Np22O/IjWll11l

# hJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0bpdS1HXeUOeLpZMlEPXh6

# I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/KmtYSWMfCWluWpiW5IP0

# wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvyCInWH8MyGOLwxS3OW560

# STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBpmLJZiWhub6e3dMNABQam

# ASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJihsMdYzaXht/a8/jyFqGa

# J+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYbBL7fQccOKO7eZS/sl/ah

# XJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbSoqKfenoi+kiVH6v7RyOA

# 9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sLgOppO6/8MO0ETI7f33Vt

# Y5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtXcVZOSEXAQsmbdlsKgEhr

# /Xmfwb1tbWrJUnMTDXpQzTGCGXMwghlvAgEBMIGVMH4xCzAJBgNVBAYTAlVTMRMw

# EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN

# aWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNp

# Z25pbmcgUENBIDIwMTECEzMAAALLt3U5+wJxQjYAAAAAAsswDQYJYIZIAWUDBAIB

# BQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEO

# MAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIHfmpPaXkEQ3EGbEHzjtp14m

# lfLcUGEHwXlzJj72jJ+dMEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8A

# cwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEB

# BQAEggEAinDyOBO/nTuQJM91j5S94YbKO9+kLGh9is6xpkHL9xYGvSurTedZaOQe

# gQSHl8hOV7a/XEl2CCfnO/r5QlXwZKW6Ira3TDzF2YE5hkahXP4NGG9NPXQnwJTN

# goOPlCfz+pn+fn2SOno3uzRrXOiohcgi5uFO+C46SqZoUstGkvVC5CSzDe75xfKA

# 9dexIaPYyoAjO1CpKzAzeOPkGkrJnTsPdO+PcC6K2EafnEwE8jg588k0O6+Q+2D3

# TRjGJTNPC9aXSnR6Z6YmuA5EOzlz5atuPxUceePD2r/NtmdytpEf9Kp14vxol8Qi

# J13AFZEE5y69x+b6+ULqIg24G0Mne6GCFv0wghb5BgorBgEEAYI3AwMBMYIW6TCC

# FuUGCSqGSIb3DQEHAqCCFtYwghbSAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFRBgsq

# hkiG9w0BCRABBKCCAUAEggE8MIIBOAIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFl

# AwQCAQUABCDRTqyOscR7NZO3mx9T9M9fEV+rjrFXaeIpG25OtbdamAIGYtfrzrjo

# GBMyMDIyMDgwNTA5MjYwNC41MThaMASAAgH0oIHQpIHNMIHKMQswCQYDVQQGEwJV

# UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE

# ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1l

# cmljYSBPcGVyYXRpb25zMSYwJAYDVQQLEx1UaGFsZXMgVFNTIEVTTjo0OUJDLUUz

# N0EtMjMzQzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaCC

# EVQwggcMMIIE9KADAgECAhMzAAABlwPPWZxriXg/AAEAAAGXMA0GCSqGSIb3DQEB

# CwUAMHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQH

# EwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNV

# BAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMB4XDTIxMTIwMjE5MDUx

# NFoXDTIzMDIyODE5MDUxNFowgcoxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNo

# aW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29y

# cG9yYXRpb24xJTAjBgNVBAsTHE1pY3Jvc29mdCBBbWVyaWNhIE9wZXJhdGlvbnMx

# JjAkBgNVBAsTHVRoYWxlcyBUU1MgRVNOOjQ5QkMtRTM3QS0yMzNDMSUwIwYDVQQD

# ExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNlMIICIjANBgkqhkiG9w0BAQEF

# AAOCAg8AMIICCgKCAgEA7QBK6kpBTfPwnv3LKx1VnL9YkozUwKzyhDKij1E6WCV/

# EwWZfPCza6cOGxKT4pjvhLXJYuUQaGRInqPks2FJ29PpyhFmhGILm4Kfh0xWYg/O

# S5Xe5pNl4PdSjAxNsjHjiB9gx6U7J+adC39Ag5XzxORzsKT+f77FMTXg1jFus7Er

# ilOvWi+znMpN+lTMgioxzTC+u1ZmTCQTu219b2FUoTr0KmVJMQqQkd7M5sR09PbO

# p4cC3jQs+5zJ1OzxIjRlcUmLvldBE6aRaSu0x3BmADGt0mGY0MRsgznOydtJBLne

# rc+QK0kcxuO6rHA3z2Kr9fmpHsfNcN/eRPtZHOLrpH59AnirQA7puz6ka20TA+8M

# hZ19hb8msrRo9LmirjFxSbGfsH3ZNEbLj3lh7Vc+DEQhMH2K9XPiU5Jkt5/6bx6/

# 2/Od3aNvC6Dx3s5N3UsW54kKI1twU2CS5q1Hov5+ARyuZk0/DbsRus6D97fB1ZoQ

# lv/4trBcMVRz7MkOrHa8bP4WqbD0ebLYtiExvx4HuEnh+0p3veNjh3gP0+7DkiVw

# IYcfVclIhFFGsfnSiFexruu646uUla+VTUuG3bjqS7FhI3hh6THov/98XfHcWeNh

# vxA5K+fi+1BcSLgQKvq/HYj/w/Mkf3bu73OERisNaacaaOCR/TJ2H3fs1A7lIHEC

# AwEAAaOCATYwggEyMB0GA1UdDgQWBBRtzwHPKOswbpZVC9Gxvt1+vRUAYDAfBgNV

# HSMEGDAWgBSfpxVdAF5iXYP05dJlpxtTNRnpcjBfBgNVHR8EWDBWMFSgUqBQhk5o

# dHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNyb3NvZnQlMjBU

# aW1lLVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcmwwbAYIKwYBBQUHAQEEYDBeMFwG

# CCsGAQUFBzAChlBodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRz

# L01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNydDAMBgNV

# HRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMIMA0GCSqGSIb3DQEBCwUAA4IC

# AQAESNhh0iTtMx57IXLfh4LuHbD1NG9MlLA1wYQHQBnR9U/rg3qt3Nx6e7+QuEKM

# EhKqdLf3g5RR4R/oZL5vEJVWUfISH/oSWdzqrShqcmT4Oxzc2CBs0UtnyopVDm4W

# 2Cumo3quykYPpBoGdeirvDdd153AwsJkIMgm/8sxJKbIBeT82tnrUngNmNo8u7l1

# uE0hsMAq1bivQ63fQInr+VqYJvYT0W/0PW7pA3qh4ocNjiX6Z8d9kjx8L7uBPI/H

# sxifCj/8mFRvpVBYOyqP7Y5di5ZAnjTDSHMZNUFPHt+nhFXUcHjXPRRHCMqqJg4D

# 63X6b0V0R87Q93ipwGIXBMzOMQNItJORekHtHlLi3bg6Lnpjs0aCo5/RlHCjNkSD

# g+xV7qYea37L/OKTNjqmH3pNAa3BvP/rDQiGEYvgAbVHEIQz7WMWSYsWeUPFZI36

# mCjgUY6V538CkQtDwM8BDiAcy+quO8epykiP0H32yqwDh852BeWm1etF+Pkw/t8X

# O3Q+diFu7Ggiqjdemj4VfpRsm2tTN9HnAewrrb0XwY8QE2tp0hRdN2b0UiSxMmB4

# hNyKKXVaDLOFCdiLnsfpD0rjOH8jbECZObaWWLn9eEvDr+QNQPvS4r47L9Aa8Lr1

# Hr47VwJ5E2gCEnvYwIRDzpJhMRi0KijYN43yT6XSGR4N9jCCB3EwggVZoAMCAQIC

# EzMAAAAVxedrngKbSZkAAAAAABUwDQYJKoZIhvcNAQELBQAwgYgxCzAJBgNVBAYT

# AlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYD

# VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBS

# b290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDEwMB4XDTIxMDkzMDE4MjIyNVoX

# DTMwMDkzMDE4MzIyNVowfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0

# b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3Jh

# dGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwggIi

# MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDk4aZM57RyIQt5osvXJHm9DtWC

# 0/3unAcH0qlsTnXIyjVX9gF/bErg4r25PhdgM/9cT8dm95VTcVrifkpa/rg2Z4VG

# Iwy1jRPPdzLAEBjoYH1qUoNEt6aORmsHFPPFdvWGUNzBRMhxXFExN6AKOG6N7dcP

# 2CZTfDlhAnrEqv1yaa8dq6z2Nr41JmTamDu6GnszrYBbfowQHJ1S/rboYiXcag/P

# XfT+jlPP1uyFVk3v3byNpOORj7I5LFGc6XBpDco2LXCOMcg1KL3jtIckw+DJj361

# VI/c+gVVmG1oO5pGve2krnopN6zL64NF50ZuyjLVwIYwXE8s4mKyzbnijYjklqwB

# Sru+cakXW2dg3viSkR4dPf0gz3N9QZpGdc3EXzTdEonW/aUgfX782Z5F37ZyL9t9

# X4C626p+Nuw2TPYrbqgSUei/BQOj0XOmTTd0lBw0gg/wEPK3Rxjtp+iZfD9M269e

# wvPV2HM9Q07BMzlMjgK8QmguEOqEUUbi0b1qGFphAXPKZ6Je1yh2AuIzGHLXpyDw

# wvoSCtdjbwzJNmSLW6CmgyFdXzB0kZSU2LlQ+QuJYfM2BjUYhEfb3BvR/bLUHMVr

# 9lxSUV0S2yW6r1AFemzFER1y7435UsSFF5PAPBXbGjfHCBUYP3irRbb1Hode2o+e

# FnJpxq57t7c+auIurQIDAQABo4IB3TCCAdkwEgYJKwYBBAGCNxUBBAUCAwEAATAj

# BgkrBgEEAYI3FQIEFgQUKqdS/mTEmr6CkTxGNSnPEP8vBO4wHQYDVR0OBBYEFJ+n

# FV0AXmJdg/Tl0mWnG1M1GelyMFwGA1UdIARVMFMwUQYMKwYBBAGCN0yDfQEBMEEw

# PwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvRG9j

# cy9SZXBvc2l0b3J5Lmh0bTATBgNVHSUEDDAKBggrBgEFBQcDCDAZBgkrBgEEAYI3

# FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAf

# BgNVHSMEGDAWgBTV9lbLj+iiXGJo0T2UkFvXzpoYxDBWBgNVHR8ETzBNMEugSaBH

# hkVodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNS

# b29DZXJBdXRfMjAxMC0wNi0yMy5jcmwwWgYIKwYBBQUHAQEETjBMMEoGCCsGAQUF

# BzAChj5odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0Nl

# ckF1dF8yMDEwLTA2LTIzLmNydDANBgkqhkiG9w0BAQsFAAOCAgEAnVV9/Cqt4Swf

# ZwExJFvhnnJL/Klv6lwUtj5OR2R4sQaTlz0xM7U518JxNj/aZGx80HU5bbsPMeTC

# j/ts0aGUGCLu6WZnOlNN3Zi6th542DYunKmCVgADsAW+iehp4LoJ7nvfam++Kctu

# 2D9IdQHZGN5tggz1bSNU5HhTdSRXud2f8449xvNo32X2pFaq95W2KFUn0CS9QKC/

# GbYSEhFdPSfgQJY4rPf5KYnDvBewVIVCs/wMnosZiefwC2qBwoEZQhlSdYo2wh3D

# YXMuLGt7bj8sCXgU6ZGyqVvfSaN0DLzskYDSPeZKPmY7T7uG+jIa2Zb0j/aRAfbO

# xnT99kxybxCrdTDFNLB62FD+CljdQDzHVG2dY3RILLFORy3BFARxv2T5JL5zbcqO

# Cb2zAVdJVGTZc9d/HltEAY5aGZFrDZ+kKNxnGSgkujhLmm77IVRrakURR6nxt67I

# 6IleT53S0Ex2tVdUCbFpAUR+fKFhbHP+CrvsQWY9af3LwUFJfn6Tvsv4O+S3Fb+0

# zj6lMVGEvL8CwYKiexcdFYmNcP7ntdAoGokLjzbaukz5m/8K6TT4JDVnK+ANuOaM

# mdbhIurwJ0I9JZTmdHRbatGePu1+oDEzfbzL6Xu/OHBE0ZDxyKs6ijoIYn/ZcGNT

# TY3ugm2lBRDBcQZqELQdVTNYs6FwZvKhggLLMIICNAIBATCB+KGB0KSBzTCByjEL

# MAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1v

# bmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjElMCMGA1UECxMcTWlj

# cm9zb2Z0IEFtZXJpY2EgT3BlcmF0aW9uczEmMCQGA1UECxMdVGhhbGVzIFRTUyBF

# U046NDlCQy1FMzdBLTIzM0MxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1w

# IFNlcnZpY2WiIwoBATAHBgUrDgMCGgMVAGFA0rCNmEk0zU12DYNGMU3B1mPRoIGD

# MIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNV

# BAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQG

# A1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwDQYJKoZIhvcNAQEF

# BQACBQDmltkXMCIYDzIwMjIwODA1MDc0NzM1WhgPMjAyMjA4MDYwNzQ3MzVaMHQw

# OgYKKwYBBAGEWQoEATEsMCowCgIFAOaW2RcCAQAwBwIBAAICGrkwBwIBAAICELIw

# CgIFAOaYKpcCAQAwNgYKKwYBBAGEWQoEAjEoMCYwDAYKKwYBBAGEWQoDAqAKMAgC

# AQACAwehIKEKMAgCAQACAwGGoDANBgkqhkiG9w0BAQUFAAOBgQCYEuAYN/ddbKX1

# cRR3NoIiElfeboQt0/zYIOxx9bjBHY4jQtZFC/HKDCCo99SbZgM0tu4kAsDPKgDJ

# Wbwig35rcL+KlZ/tcZXUc61dpLdwM7wrqdPMKePIx73CPiP2KmJle3bcmCz0jEfc

# m3GlYHcVmqms1xt5o1GSjlReZ5ohnzGCBA0wggQJAgEBMIGTMHwxCzAJBgNVBAYT

# AlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYD

# VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBU

# aW1lLVN0YW1wIFBDQSAyMDEwAhMzAAABlwPPWZxriXg/AAEAAAGXMA0GCWCGSAFl

# AwQCAQUAoIIBSjAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwLwYJKoZIhvcN

# AQkEMSIEIJSVaPIAQ3he94zNbet46lrWEVNW0iQJcCCeC9eKC9u8MIH6BgsqhkiG

# 9w0BCRACLzGB6jCB5zCB5DCBvQQgW3vaGxCVejj+BAzFSfMxfHQ+bxxkqCw8LkMY

# /QZ4pr8wgZgwgYCkfjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3Rv

# bjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0

# aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAA

# AZcDz1mca4l4PwABAAABlzAiBCAD1/BjTFqy+ADpFnMOdCeS/ES6Pnri/6FPO2lB

# 9/OkFjANBgkqhkiG9w0BAQsFAASCAgAGYZd1WIPqkv+q1Ao8hNzGYdTBxM7WyQOp

# pPc1ABbMKNq2Xj0Kj+egfVyasIDEh7XUXqSnoL4u7Ne1sq66k8rseQ7L/yLErMKn

# 9eZo0TkFvcB8qx9UC7OS4QDNFQ1q06Lqu0oUDe7sHvbYOJPbNYk8jkeQQlOiNr12

# aAOcG5XaVA1d2vVxmVg0jwQo1T2ULyaEdDpO2yr00N/aSrHE4kiIaeTgpaAt2Col

# EMUCzU++6ue6MI1vyaFJ8uS4ZV1DRHkTJV8mrL7Qpym2Y9Hg9G7hlkPyRWCD3+dB

# Ac0/Aa6fa9uoqUn3jJxOlkXiqyh92XbGfu+/KFxpLeXjsqKy00mIg9z3b+yOptbr

# o5O3JPAG9ugaww3IMbt6kYkc0DjxywWHYXypqL6PVujBTryyITwnwlTgZwa4rH90

# XEsSiEPQCyYELUkxhW/XiZOGQ/zangwVlSJt7QG/jSXvZqk9jCckZNY627yKhS0U

# 1bUDcc1aigb8zg4pps+M3/XdA75VhX9QfkO8z9kpUJRW68KhT58GJUTTBjBpYoMi

# Msvtg7QT6YlMu4aj6VtV8QdJTIZyaOvcccIJkZpQkpbEPSgjYCB9wxqbUnjWVbJT

# aP1j6HNzurkYskXOPh0JTMyio/M7kwDmh3IpANYMNHMcABG/Eeele+lziBJuKgdh

# irF/PlpIoA==

# SIG # End signature block