PSRule.Rules.Azure

1.30.0-B0080

rules/Azure.Subscription.Rule.ps1

                                # Copyright (c) Microsoft Corporation.

# Licensed under the MIT License.

#

# Validation rules for Azure subscriptions

#

#region RBAC

# Synopsis: Use groups for assigning permissions instead of individual user accounts

Rule 'Azure.RBAC.UseGroups' -Ref 'AZR-000203' -Type 'Microsoft.Subscription' -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Security'; } -Labels @{ 'Azure.MCSB.v1/control' = 'PA-7' } {

    $assignments = @($TargetObject.resources | Where-Object {

        $_.ResourceType -eq 'Microsoft.Authorization/roleAssignments' -and

        $_.ObjectType -eq 'User'

    })

    $Assert.

        LessOrEqual($assignments, 'Length', 5).

        WithReason(($LocalizedData.RoleAssignmentCount -f $assignments.Length), $True)

}

# Synopsis: Limit the number of subscription Owners

Rule 'Azure.RBAC.LimitOwner' -Ref 'AZR-000204' -Type 'Microsoft.Subscription' -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Security'; } -Labels @{ 'Azure.MCSB.v1/control' = 'PA-7' } {

    $assignments = @($TargetObject.resources | Where-Object {

        $_.ResourceType -eq 'Microsoft.Authorization/roleAssignments' -and

        $_.RoleDefinitionName -eq 'Owner' -and

        ($_.Scope -like "/subscriptions/*" -or "/providers/Microsoft.Management/managementGroups/*") -and

        $_.Scope -notlike "/subscriptions/*/resourceGroups/*"

    })

    $Assert.

        LessOrEqual($assignments, 'Length', 3).

        WithReason(($LocalizedData.RoleAssignmentCount -f $assignments.Length), $True)

}

# Synopsis: Limit RBAC inheritance from Management Groups

Rule 'Azure.RBAC.LimitMGDelegation' -Ref 'AZR-000205' -Type 'Microsoft.Subscription' -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Security'; } -Labels @{ 'Azure.MCSB.v1/control' = 'PA-7' } {

    $assignments = @($TargetObject.resources | Where-Object {

        $_.ResourceType -eq 'Microsoft.Authorization/roleAssignments' -and

        ($_.Scope -like "/providers/Microsoft.Management/managementGroups/*")

    })

    $Assert.

        LessOrEqual($assignments, 'Length', 3).

        WithReason(($LocalizedData.RoleAssignmentCount -f $assignments.Length), $True)

}

# Synopsis: Avoid using classic co-administrator roles

Rule 'Azure.RBAC.CoAdministrator' -Ref 'AZR-000206' -Type 'Microsoft.Subscription' -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Security'; } -Labels @{ 'Azure.MCSB.v1/control' = 'PA-7' } {

    $assignments = @($TargetObject.resources | Where-Object {

        $_.ResourceType -eq 'Microsoft.Authorization/roleAssignments' -and

        $_.RoleDefinitionName -eq 'CoAdministrator'

    })

    $Assert.

        LessOrEqual($assignments, 'Length', 0).

        WithReason(($LocalizedData.RoleAssignmentCount -f $assignments.Length), $True)

}

# Synopsis: Use RBAC assignments on resource groups instead of individual resources

Rule 'Azure.RBAC.UseRGDelegation' -Ref 'AZR-000207' -Type 'Microsoft.Resources/resourceGroups' -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Security'; } -Labels @{ 'Azure.MCSB.v1/control' = 'PA-7' } {

    $assignments = @($TargetObject.resources | Where-Object {

        $_.ResourceType -eq 'Microsoft.Authorization/roleAssignments' -and

        $_.Scope -like "/subscriptions/*/resourceGroups/*/providers/*"

    })

    $Assert.

        LessOrEqual($assignments, 'Length', 0).

        WithReason(($LocalizedData.RoleAssignmentCount -f $assignments.Length), $True)

}

# Synopsis: Use JiT role activation with PIM

Rule 'Azure.RBAC.PIM' -Ref 'AZR-000208' -Type 'Microsoft.Subscription' -Tag @{ release = 'GA'; ruleSet = '2020_09'; 'Azure.WAF/pillar' = 'Security'; } -Labels @{ 'Azure.MCSB.v1/control' = 'PA-7' } {

    # Get PIM assignment

    $assignments = @(GetSubResources -ResourceType 'Microsoft.Authorization/roleAssignments' | Where-Object {

        $_.DisplayName -eq 'MS-PIM' -and $_.ObjectType -eq 'ServicePrincipal'

    })

    $Assert.

        HasFieldValue($assignments, 'Length', 1).

        WithReason($LocalizedData.UnmanagedSubscription, $True)

}

#endregion RBAC

#region Security Center

# Synopsis: Microsoft Defender for Cloud email and phone contact details should be set

Rule 'Azure.DefenderCloud.Contact' -Alias 'Azure.SecurityCenter.Contact' -Ref 'AZR-000209' -Type 'Microsoft.Subscription' -Tag @{ release = 'GA'; ruleSet = '2020_06' } {

    Reason $LocalizedData.SecurityCenterNotConfigured;

    $contacts = @(GetSubResources -ResourceType 'Microsoft.Security/securityContacts');

    $Null -ne $contacts -and $contacts.Length -gt 0;

    foreach ($c in $contacts) {

        $Assert.HasFieldValue($c, 'Properties.Email')

        $Assert.HasFieldValue($c, 'Properties.Phone');

    }

}

# TODO: Check Security Center recommendations

# Synopsis: Enable auto-provisioning on VMs to improve Microsoft Defender for Cloud insights

Rule 'Azure.DefenderCloud.Provisioning' -Alias 'Azure.SecurityCenter.Provisioning' -Ref 'AZR-000210' -Type 'Microsoft.Subscription' -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Security'; } -Labels @{ 'Azure.MCSB.v1/control' = 'LT-4' } {

    $provisioning = @(GetSubResources -ResourceType 'Microsoft.Security/autoProvisioningSettings');

    $Null -ne $provisioning -and $provisioning.Length -gt 0;

    foreach ($s in $provisioning) {

        $Assert.HasFieldValue($s, 'Properties.autoProvision', 'On');

    }

}

#endregion Security Center

# TODO: Use policy

# TODO: Use resource locks

#region Monitor

# Synopsis: Configure Azure service logs

Rule 'Azure.Monitor.ServiceHealth' -Ref 'AZR-000211' -Type 'Microsoft.Subscription' -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Security'; } -Labels @{ 'Azure.MCSB.v1/control' = 'LT-4' } {

    $alerts = @(GetSubResources -ResourceType 'microsoft.insights/activityLogAlerts' | Where-Object {

        @($_.Properties.condition.allOf | Where-Object { $_.field -eq 'category' -and $_.equals -eq 'ServiceHealth' }).Length -gt 0

    });

    $Null -ne $alerts -and $alerts.Length -gt 0;

    foreach ($alert in $alerts) {

        $Assert.HasFieldValue($alert, 'Properties.enabled', $True);

    }

}

#endregion Monitor

# SIG # Begin signature block

# MIInzAYJKoZIhvcNAQcCoIInvTCCJ7kCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCIYXW579npDa1C

# sHvvyj2IX4UmxpgVVfkvKJ89q3ndVaCCDYUwggYDMIID66ADAgECAhMzAAADTU6R

# phoosHiPAAAAAANNMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD

# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p

# bmcgUENBIDIwMTEwHhcNMjMwMzE2MTg0MzI4WhcNMjQwMzE0MTg0MzI4WjB0MQsw

# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u

# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB

# AQDUKPcKGVa6cboGQU03ONbUKyl4WpH6Q2Xo9cP3RhXTOa6C6THltd2RfnjlUQG+

# Mwoy93iGmGKEMF/jyO2XdiwMP427j90C/PMY/d5vY31sx+udtbif7GCJ7jJ1vLzd

# j28zV4r0FGG6yEv+tUNelTIsFmmSb0FUiJtU4r5sfCThvg8dI/F9Hh6xMZoVti+k

# bVla+hlG8bf4s00VTw4uAZhjGTFCYFRytKJ3/mteg2qnwvHDOgV7QSdV5dWdd0+x

# zcuG0qgd3oCCAjH8ZmjmowkHUe4dUmbcZfXsgWlOfc6DG7JS+DeJak1DvabamYqH

# g1AUeZ0+skpkwrKwXTFwBRltAgMBAAGjggGCMIIBfjAfBgNVHSUEGDAWBgorBgEE

# AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUId2Img2Sp05U6XI04jli2KohL+8w

# VAYDVR0RBE0wS6RJMEcxLTArBgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJh

# dGlvbnMgTGltaXRlZDEWMBQGA1UEBRMNMjMwMDEyKzUwMDUxNzAfBgNVHSMEGDAW

# gBRIbmTlUAXTgqoXNzcitW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8v

# d3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIw

# MTEtMDctMDguY3JsMGEGCCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDov

# L3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDEx

# XzIwMTEtMDctMDguY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIB

# ACMET8WuzLrDwexuTUZe9v2xrW8WGUPRQVmyJ1b/BzKYBZ5aU4Qvh5LzZe9jOExD

# YUlKb/Y73lqIIfUcEO/6W3b+7t1P9m9M1xPrZv5cfnSCguooPDq4rQe/iCdNDwHT

# 6XYW6yetxTJMOo4tUDbSS0YiZr7Mab2wkjgNFa0jRFheS9daTS1oJ/z5bNlGinxq

# 2v8azSP/GcH/t8eTrHQfcax3WbPELoGHIbryrSUaOCphsnCNUqUN5FbEMlat5MuY

# 94rGMJnq1IEd6S8ngK6C8E9SWpGEO3NDa0NlAViorpGfI0NYIbdynyOB846aWAjN

# fgThIcdzdWFvAl/6ktWXLETn8u/lYQyWGmul3yz+w06puIPD9p4KPiWBkCesKDHv

# XLrT3BbLZ8dKqSOV8DtzLFAfc9qAsNiG8EoathluJBsbyFbpebadKlErFidAX8KE

# usk8htHqiSkNxydamL/tKfx3V/vDAoQE59ysv4r3pE+zdyfMairvkFNNw7cPn1kH

# Gcww9dFSY2QwAxhMzmoM0G+M+YvBnBu5wjfxNrMRilRbxM6Cj9hKFh0YTwba6M7z

# ntHHpX3d+nabjFm/TnMRROOgIXJzYbzKKaO2g1kWeyG2QtvIR147zlrbQD4X10Ab

# rRg9CpwW7xYxywezj+iNAc+QmFzR94dzJkEPUSCJPsTFMIIHejCCBWKgAwIBAgIK

# YQ6Q0gAAAAAAAzANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNV

# BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv

# c29mdCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlm

# aWNhdGUgQXV0aG9yaXR5IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEw

# OTA5WjB+MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE

# BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYD

# VQQDEx9NaWNyb3NvZnQgQ29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG

# 9w0BAQEFAAOCAg8AMIICCgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+la

# UKq4BjgaBEm6f8MMHt03a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc

# 6Whe0t+bU7IKLMOv2akrrnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4D

# dato88tt8zpcoRb0RrrgOGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+

# lD3v++MrWhAfTVYoonpy4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nk

# kDstrjNYxbc+/jLTswM9sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6

# A4aN91/w0FK/jJSHvMAhdCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmd

# X4jiJV3TIUs+UsS1Vz8kA/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL

# 5zmhD+kjSbwYuER8ReTBw3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zd

# sGbiwZeBe+3W7UvnSSmnEyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3

# T8HhhUSJxAlMxdSlQy90lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS

# 4NaIjAsCAwEAAaOCAe0wggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRI

# bmTlUAXTgqoXNzcitW2oynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTAL

# BgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBD

# uRQFTuHqp8cx0SOJNDBaBgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jv

# c29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFf

# MDNfMjIuY3JsMF4GCCsGAQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3

# dy5taWNyb3NvZnQuY29tL3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFf

# MDNfMjIuY3J0MIGfBgNVHSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEF

# BQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1h

# cnljcHMuaHRtMEAGCCsGAQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkA

# YwB5AF8AcwB0AGEAdABlAG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn

# 8oalmOBUeRou09h0ZyKbC5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7

# v0epo/Np22O/IjWll11lhJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0b

# pdS1HXeUOeLpZMlEPXh6I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/

# KmtYSWMfCWluWpiW5IP0wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvy

# CInWH8MyGOLwxS3OW560STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBp

# mLJZiWhub6e3dMNABQamASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJi

# hsMdYzaXht/a8/jyFqGaJ+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYb

# BL7fQccOKO7eZS/sl/ahXJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbS

# oqKfenoi+kiVH6v7RyOA9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sL

# gOppO6/8MO0ETI7f33VtY5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtX

# cVZOSEXAQsmbdlsKgEhr/Xmfwb1tbWrJUnMTDXpQzTGCGZ0wghmZAgEBMIGVMH4x

# CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRt

# b25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01p

# Y3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMTECEzMAAANNTpGmGiiweI8AAAAA

# A00wDQYJYIZIAWUDBAIBBQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQw

# HAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIHaJ

# M27/THEdnHIeQj1r4Sz4WQTXQ4TVaAlDhQ/06O/TMEIGCisGAQQBgjcCAQwxNDAy

# oBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5j

# b20wDQYJKoZIhvcNAQEBBQAEggEAHFjVIdGCiCYBtv0VXb/pcGbvDOwequ+cLcN9

# GeQfD9xdI8Bj+S8nXlYt35FFFKXwYCBpDsUzISo4yM9AbTnwIWG5jn7NX/H7J+MW

# n4fcOQtNrS24hQU57Mro+JXGgeGXA5JxGcPNeheVrPsmHAlbOFAKE4dmto8LDGqE

# AqMx0mJBjUJ2caCap+5cXnLRYme3oGf95K9EV/zoReMY3rlVqdMJFzEAtLCJKS3l

# qJk9mIOsQeQDpxNcvOBJOf+fAJLtZ0Pz8DkA6Q+CSTLKaXRmNi+ijZ1rrWE0Q56N

# ufQYzGdJzTB66jnkH3a3zpqGKESkD9CJI5ACKowYDeA36YsPEKGCFycwghcjBgor

# BgEEAYI3AwMBMYIXEzCCFw8GCSqGSIb3DQEHAqCCFwAwghb8AgEDMQ8wDQYJYIZI

# AWUDBAIBBQAwggFXBgsqhkiG9w0BCRABBKCCAUYEggFCMIIBPgIBAQYKKwYBBAGE

# WQoDATAxMA0GCWCGSAFlAwQCAQUABCCBjSwySlMrGAa1/JsoQFKsaPziDZCJvXx/

# M+MmrKGgLQIGZN5VGTYEGBEyMDIzMDkxNTAxNDY1NC4yWjAEgAIB9KCB2KSB1TCB

# 0jELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1Jl

# ZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEtMCsGA1UECxMk

# TWljcm9zb2Z0IElyZWxhbmQgT3BlcmF0aW9ucyBMaW1pdGVkMSYwJAYDVQQLEx1U

# aGFsZXMgVFNTIEVTTjowODQyLTRCRTYtQzI5QTElMCMGA1UEAxMcTWljcm9zb2Z0

# IFRpbWUtU3RhbXAgU2VydmljZaCCEXgwggcnMIIFD6ADAgECAhMzAAABsm5AA39u

# qZSSAAEAAAGyMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQI

# EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv

# ZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBD

# QSAyMDEwMB4XDTIyMDkyMDIwMjIwMVoXDTIzMTIxNDIwMjIwMVowgdIxCzAJBgNV

# BAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4w

# HAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xLTArBgNVBAsTJE1pY3Jvc29m

# dCBJcmVsYW5kIE9wZXJhdGlvbnMgTGltaXRlZDEmMCQGA1UECxMdVGhhbGVzIFRT

# UyBFU046MDg0Mi00QkU2LUMyOUExJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0

# YW1wIFNlcnZpY2UwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDKomUy

# HXv5UOKwvgZpeX/1rqv8Sk8a32xttx6H5kPqmQDeBsju9zxd8vTgH6be0H9o3JXV

# jhlAfh8wbsJZWMj938eDGPM77gLgd+xb6MrZzQtgyp1a1ZRzlXBlC/Qp5oQzTANv

# 57JIyH9iKIhvSdKi2K/Hbrx3UCfS4tj6vYLskm/Zr1C+tKILJQjvYJIehYhA8DK8

# FK/Fo2uoxaVE58vLYNDdHJwjdsOHypKeamXG1GBWInC0m/+gO6RwrV+sZ46sIZia

# Im975CiclcW7hS0YVV8R/eW9Cx3jYYn59476No/v+EFddIxKV1VvogvQbE7Uevcb

# 041OdWYD+wUeGAxFquybMpUjr+QeUx0w10X9fOFEcxYU8m/DmUCmO5qjIe3PCfMN

# bBDOFw1BdlGTcvNvTVQsxtrX3RF2Wh8RfEZsaUGAccoWcGNa6LbiEvoHzdnqvoZA

# E94qRp/Pypg8A7cwG537l4wKYHmasIHGCfKQyfsv8VOqLsyc9Qb3uU04oZIgO8EL

# EHuketGZPXT3Tc8NDCuZ4kc7kGQLeBiPehYY4ZVFnFGTgpL/yVzPzhrv64EqZWMH

# Zjy883w7V8rsvxglOSOJdPIOoon18qTIKGJJHHjgAM+L8dcdATp2VnyN30sKjVL6

# De53E0/jAeFab39UAaaYwQEFLr7ounghtDAlTQIDAQABo4IBSTCCAUUwHQYDVR0O

# BBYEFJnyJ4Bc2RGZT5IwzlZbgUgw2mpxMB8GA1UdIwQYMBaAFJ+nFV0AXmJdg/Tl

# 0mWnG1M1GelyMF8GA1UdHwRYMFYwVKBSoFCGTmh0dHA6Ly93d3cubWljcm9zb2Z0

# LmNvbS9wa2lvcHMvY3JsL01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAy

# MDEwKDEpLmNybDBsBggrBgEFBQcBAQRgMF4wXAYIKwYBBQUHMAKGUGh0dHA6Ly93

# d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwVGltZS1T

# dGFtcCUyMFBDQSUyMDIwMTAoMSkuY3J0MAwGA1UdEwEB/wQCMAAwFgYDVR0lAQH/

# BAwwCgYIKwYBBQUHAwgwDgYDVR0PAQH/BAQDAgeAMA0GCSqGSIb3DQEBCwUAA4IC

# AQDcR7btxcyGm2g21qrMHSgZQISl0QjfuQkjIr9k2GuItkLliJvvfaYsAIQ4QA32

# 6qK9c8i4veWOhkJ7yFlIHXgu6C9WbWcnvds2CvhCH8GGZoUvgh+Ip3wM1L7HB2Rd

# 8JayVHz1CAxlT9JQmFbHvZoLrxtHapGOGskDxBzrybm4GWWjnYPzfHSJ3enxnjnP

# tA6Bswfi4njmydkNALRLd1zd4l/AqevnWU1/McBPy74UcD6W//pyrITu01br3p8H

# U8Kgfy0+gjT2hJcBXisSq6kUzzGx3oPovipwS38JoRF7DINrNUF+ySMX70/epndH

# ojI4jBDtti2zs5izDXdyyDaMAJ0QQCbV/t/3t/dAfbDBjB6fmtVfoYLOtgKKQZdK

# f9NJYt9AzecBEOSH9+WZO2/0+qRMeqyVA2ArYu8wm4pIyk2pwZznPfcxjJXo+V/n

# wv5ORMVAqzrN/1cxkQmbeS71UEnVqqv0DM0xJopuLG8wEivYphJIzbWWcrwtQrFH

# A9b6BZLZXeJijIxPrgxFdyHXQ/g60ZPeJ1czT0rmV3sH1Tp1x0nqhu8TN1e35dmi

# +L9ToS9vicDtU8dwdIqztTvamzXSZN+eW57XdUUlSoDNtihQR56C+ybO6UYQYmip

# lU0BqDm/o9UGu6vnIsRqOPFYfZN+QQ7CUvwy6FxUjw5eJjCCB3EwggVZoAMCAQIC

# EzMAAAAVxedrngKbSZkAAAAAABUwDQYJKoZIhvcNAQELBQAwgYgxCzAJBgNVBAYT

# AlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYD

# VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBS

# b290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDEwMB4XDTIxMDkzMDE4MjIyNVoX

# DTMwMDkzMDE4MzIyNVowfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0

# b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3Jh

# dGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwggIi

# MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDk4aZM57RyIQt5osvXJHm9DtWC

# 0/3unAcH0qlsTnXIyjVX9gF/bErg4r25PhdgM/9cT8dm95VTcVrifkpa/rg2Z4VG

# Iwy1jRPPdzLAEBjoYH1qUoNEt6aORmsHFPPFdvWGUNzBRMhxXFExN6AKOG6N7dcP

# 2CZTfDlhAnrEqv1yaa8dq6z2Nr41JmTamDu6GnszrYBbfowQHJ1S/rboYiXcag/P

# XfT+jlPP1uyFVk3v3byNpOORj7I5LFGc6XBpDco2LXCOMcg1KL3jtIckw+DJj361

# VI/c+gVVmG1oO5pGve2krnopN6zL64NF50ZuyjLVwIYwXE8s4mKyzbnijYjklqwB

# Sru+cakXW2dg3viSkR4dPf0gz3N9QZpGdc3EXzTdEonW/aUgfX782Z5F37ZyL9t9

# X4C626p+Nuw2TPYrbqgSUei/BQOj0XOmTTd0lBw0gg/wEPK3Rxjtp+iZfD9M269e

# wvPV2HM9Q07BMzlMjgK8QmguEOqEUUbi0b1qGFphAXPKZ6Je1yh2AuIzGHLXpyDw

# wvoSCtdjbwzJNmSLW6CmgyFdXzB0kZSU2LlQ+QuJYfM2BjUYhEfb3BvR/bLUHMVr

# 9lxSUV0S2yW6r1AFemzFER1y7435UsSFF5PAPBXbGjfHCBUYP3irRbb1Hode2o+e

# FnJpxq57t7c+auIurQIDAQABo4IB3TCCAdkwEgYJKwYBBAGCNxUBBAUCAwEAATAj

# BgkrBgEEAYI3FQIEFgQUKqdS/mTEmr6CkTxGNSnPEP8vBO4wHQYDVR0OBBYEFJ+n

# FV0AXmJdg/Tl0mWnG1M1GelyMFwGA1UdIARVMFMwUQYMKwYBBAGCN0yDfQEBMEEw

# PwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvRG9j

# cy9SZXBvc2l0b3J5Lmh0bTATBgNVHSUEDDAKBggrBgEFBQcDCDAZBgkrBgEEAYI3

# FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAf

# BgNVHSMEGDAWgBTV9lbLj+iiXGJo0T2UkFvXzpoYxDBWBgNVHR8ETzBNMEugSaBH

# hkVodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNS

# b29DZXJBdXRfMjAxMC0wNi0yMy5jcmwwWgYIKwYBBQUHAQEETjBMMEoGCCsGAQUF

# BzAChj5odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0Nl

# ckF1dF8yMDEwLTA2LTIzLmNydDANBgkqhkiG9w0BAQsFAAOCAgEAnVV9/Cqt4Swf

# ZwExJFvhnnJL/Klv6lwUtj5OR2R4sQaTlz0xM7U518JxNj/aZGx80HU5bbsPMeTC

# j/ts0aGUGCLu6WZnOlNN3Zi6th542DYunKmCVgADsAW+iehp4LoJ7nvfam++Kctu

# 2D9IdQHZGN5tggz1bSNU5HhTdSRXud2f8449xvNo32X2pFaq95W2KFUn0CS9QKC/

# GbYSEhFdPSfgQJY4rPf5KYnDvBewVIVCs/wMnosZiefwC2qBwoEZQhlSdYo2wh3D

# YXMuLGt7bj8sCXgU6ZGyqVvfSaN0DLzskYDSPeZKPmY7T7uG+jIa2Zb0j/aRAfbO

# xnT99kxybxCrdTDFNLB62FD+CljdQDzHVG2dY3RILLFORy3BFARxv2T5JL5zbcqO

# Cb2zAVdJVGTZc9d/HltEAY5aGZFrDZ+kKNxnGSgkujhLmm77IVRrakURR6nxt67I

# 6IleT53S0Ex2tVdUCbFpAUR+fKFhbHP+CrvsQWY9af3LwUFJfn6Tvsv4O+S3Fb+0

# zj6lMVGEvL8CwYKiexcdFYmNcP7ntdAoGokLjzbaukz5m/8K6TT4JDVnK+ANuOaM

# mdbhIurwJ0I9JZTmdHRbatGePu1+oDEzfbzL6Xu/OHBE0ZDxyKs6ijoIYn/ZcGNT

# TY3ugm2lBRDBcQZqELQdVTNYs6FwZvKhggLUMIICPQIBATCCAQChgdikgdUwgdIx

# CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRt

# b25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xLTArBgNVBAsTJE1p

# Y3Jvc29mdCBJcmVsYW5kIE9wZXJhdGlvbnMgTGltaXRlZDEmMCQGA1UECxMdVGhh

# bGVzIFRTUyBFU046MDg0Mi00QkU2LUMyOUExJTAjBgNVBAMTHE1pY3Jvc29mdCBU

# aW1lLVN0YW1wIFNlcnZpY2WiIwoBATAHBgUrDgMCGgMVAI4SfhHskkX59igjbI5/

# XBfQFEk6oIGDMIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0

# b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3Jh

# dGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwDQYJ

# KoZIhvcNAQEFBQACBQDorbnsMCIYDzIwMjMwOTE1MDA1NzE2WhgPMjAyMzA5MTYw

# MDU3MTZaMHQwOgYKKwYBBAGEWQoEATEsMCowCgIFAOituewCAQAwBwIBAAICAZgw

# BwIBAAICEcEwCgIFAOivC2wCAQAwNgYKKwYBBAGEWQoEAjEoMCYwDAYKKwYBBAGE

# WQoDAqAKMAgCAQACAwehIKEKMAgCAQACAwGGoDANBgkqhkiG9w0BAQUFAAOBgQCg

# pNw34JrjzhExXYxolUxkUnAhxit8YVa79rN6zvT8YpJJtbxTTeXdEPC70124tSLs

# 2S+KKbRyXMKs8t2zHdjjFOMNkTYzUsTrLLllekljX6RUed81zFp/jSQBczBwbIl3

# bdvJqTsQowfyNUmlVZoUStyRLl7hg4jux6edUSm1nDGCBA0wggQJAgEBMIGTMHwx

# CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRt

# b25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1p

# Y3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAABsm5AA39uqZSSAAEAAAGy

# MA0GCWCGSAFlAwQCAQUAoIIBSjAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQw

# LwYJKoZIhvcNAQkEMSIEIHqU3Hk6ioalkorcQZFKkuraUOhbplKD4qcRXyfTwm8d

# MIH6BgsqhkiG9w0BCRACLzGB6jCB5zCB5DCBvQQgU3jOPOfhPreDxFYnlKBSl+z1

# ci6P587vobSTwhtOPjUwgZgwgYCkfjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMK

# V2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0

# IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0Eg

# MjAxMAITMwAAAbJuQAN/bqmUkgABAAABsjAiBCDepmPaE9UhDag1WYWRnONqCcor

# Ka548NDthdl5dloqazANBgkqhkiG9w0BAQsFAASCAgCyrYKXGTHHOfKPjdy2+buS

# 1E4H3X+FYnkHhoIYsYErwD3tVNF+fbMzQEUX/2RqxzKRry7RXZrSWHl6EKF8bm6Y

# YqEK3UHke19sLh4DOlvTbpRGTVQ0tu5jYjye/kLPdDTHaH6jxh3APMzEIKL6uRN7

# oNjjQZTI4s0llTNtAhJzlyWJ7UmFsPmfBB4jMv1sFUWXXp6qxSYVmi7bRf0jwn9e

# zUAjmXpzj+BFOwMwBcRiPP17r/+sWmLfClM7FkakdWrzWbcRXy8Ao14AFfNjKLhJ

# wiil2pHKRikNCUXaK5yqFgkvSrwkyRIztvN9ZsiPcOWR5yGQBFQFt2gM07SbY6XE

# tvEhyfjLHw165KeizYXJjmLcXQeGGtpSJPJfeY0945EBG+/7CThNjd2+8lKD74Rq

# pShuPNy4d7ETvHmEFnAnfZsisvhYT0CTnIU4DfUDO8u7e3/KCOY+XZZAsVvbNcAO

# +gV+NW/Q18S51cDTMO8irBlicOzgEHSZbvK7HGVpV23/tQciKTpQwUD7wFnn47W7

# iFL1Zuj4y1QMuLTKPMzzXbi3jtZ3I957Gns9gX9hvDGWaJiSIzNgUezJBOToutfu

# E+iKnHgnlyhFco2CjsoLjG3zVGBvV+F2ty9m4dN5nR3HC60Hv/8/1jPB2YR96uzA

# DKWKDoGjU3tSaXok7DlVWw==

# SIG # End signature block