PSRule.Rules.Azure

1.30.2

rules/Azure.VNET.Rule.ps1

                                # Copyright (c) Microsoft Corporation.

# Licensed under the MIT License.

#

# Validation rules for virtual networking

#

#region Virtual Network

# Synopsis: Virtual network (VNET) subnets should have Network Security Groups (NSGs) assigned.

Rule 'Azure.VNET.UseNSGs' -Ref 'AZR-000263' -Type 'Microsoft.Network/virtualNetworks', 'Microsoft.Network/virtualNetworks/subnets' -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Security'; 'Azure.MCSB.v1/control' = 'NS-1' } {

    $excludedSubnets = @('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet');

    $subnet = @($TargetObject);

    if ($PSRule.TargetType -eq 'Microsoft.Network/virtualNetworks') {

        # Get subnets

        $subnet = @($TargetObject.properties.subnets | Where-Object {

                $_.Name -notin $excludedSubnets -and @($_.properties.delegations | Where-Object { $_.properties.serviceName -eq 'Microsoft.HardwareSecurityModules/dedicatedHSMs' }).Length -eq 0

            });

        if ($subnet.Length -eq 0 -or !$Assert.HasFieldValue($TargetObject, 'properties.subnets').Result) {

            return $Assert.Pass();

        }

    }

    elseif ($PSRule.TargetType -eq 'Microsoft.Network/virtualNetworks/subnets' -and

    ($PSRule.TargetName -in $excludedSubnets -or @($TargetObject.properties.delegations | Where-Object { $_.properties.serviceName -eq 'Microsoft.HardwareSecurityModules/dedicatedHSMs' }).Length -gt 0)) {

        return $Assert.Pass();

    }

    foreach ($sn in $subnet) {

        $Assert.

        HasFieldValue($sn, 'properties.networkSecurityGroup.id').

        WithReason(($LocalizedData.SubnetNSGNotConfigured -f $sn.Name), $True);

    }

}

# TODO: Check that NSG on GatewaySubnet is not defined

# Synopsis: VNETs should have at least two DNS servers assigned.

Rule 'Azure.VNET.SingleDNS' -Ref 'AZR-000264' -Type 'Microsoft.Network/virtualNetworks' -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Reliability'; } {

    # If DNS servers are customized, at least two IP addresses should be defined

    if ($Assert.NullOrEmpty($TargetObject, 'properties.dhcpOptions.dnsServers').Result) {

        $Assert.Pass()

    }

    else {

        $Assert.GreaterOrEqual($TargetObject, 'properties.dhcpOptions.dnsServers', 2);

    }

}

# Synopsis: Virtual networks (VNETs) should use Azure local DNS servers.

Rule 'Azure.VNET.LocalDNS' -Ref 'AZR-000265' -Type 'Microsoft.Network/virtualNetworks' -If { (IsExport) -and !($Configuration.GetBoolOrDefault('AZURE_VNET_DNS_WITH_IDENTITY', $False)) } -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Reliability'; } {

    # If DNS servers are customized, check what range the IPs are in

    if ($Assert.NullOrEmpty($TargetObject, 'properties.dhcpOptions.dnsServers').Result) {

        $Assert.Pass()

    }

    else {

        # Primary DNS server must be within VNET address space or peered VNET

        $dnsServers = @($TargetObject.properties.dhcpOptions.dnsServers)

        $primary = $dnsServers[0]

        $localRanges = @();

        $localRanges += $TargetObject.properties.addressSpace.addressPrefixes

        if ($Assert.HasFieldValue($TargetObject, 'properties.virtualNetworkPeerings').Result) {

            $localRanges += $TargetObject.properties.virtualNetworkPeerings.properties.remoteAddressSpace.addressPrefixes

        }

        # Determine if the primary is in range

        WithinCIDR -IP $primary -CIDR $localRanges

    }

}

# Synopsis: VNET peering connections must be connected.

Rule 'Azure.VNET.PeerState' -Ref 'AZR-000266' -If { (HasPeerNetwork) } -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Operational Excellence'; } {

    $peers = @($TargetObject.properties.virtualNetworkPeerings);

    foreach ($peer in $peers) {

        $Assert.HasFieldValue($peer, 'Properties.peeringState', 'Connected');

    }

}

# Synopsis: Subnet names should meet naming requirements.

Rule 'Azure.VNET.SubnetName' -Ref 'AZR-000267' -Type 'Microsoft.Network/virtualNetworks', 'Microsoft.Network/virtualNetworks/subnets' -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Operational Excellence'; } {

    # https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftnetwork

    if ($PSRule.TargetType -eq 'Microsoft.Network/virtualNetworks') {

        $subnets = @($TargetObject.properties.subnets)

        if ($subnets.Length -eq 0 -or !$Assert.HasFieldValue($TargetObject, 'properties.subnets').Result) {

            $Assert.Pass();

        }

        else {

            foreach ($subnet in $subnets) {

                # Between 1 and 80 characters long

                $Assert.GreaterOrEqual($subnet, 'Name', 1)

                $Assert.LessOrEqual($subnet, 'Name', 80)

                # Alphanumerics, underscores, periods, and hyphens.

                # Start with alphanumeric. End alphanumeric or underscore.

                $subnet | Match 'Name' '^[A-Za-z0-9]((-|\.)*\w){0,79}$'

            }

        }

    }

    elseif ($PSRule.TargetType -eq 'Microsoft.Network/virtualNetworks/subnets') {

        $nameParts = $PSRule.TargetName.Split('/');

        $name = $nameParts[-1];

        # Between 1 and 80 characters long

        $Assert.GreaterOrEqual($name, '.', 1)

        $Assert.LessOrEqual($name, '.', 80)

        # Alphanumerics, underscores, periods, and hyphens.

        # Start with alphanumeric. End alphanumeric or underscore.

        $name | Match '.' '^[A-Za-z0-9]((-|\.)*\w){0,79}$'

    }

}

# Synopsis: VNETs with a GatewaySubnet should have an AzureBastionSubnet to allow for out of band remote access to VMs.

Rule 'Azure.VNET.BastionSubnet' -Ref 'AZR-000314' -Type 'Microsoft.Network/virtualNetworks' -If { HasGatewaySubnet } -Tag @{ release = 'GA'; ruleSet = '2022_12'; 'Azure.WAF/pillar' = 'Reliability'; } {

    $subnets = @(GetVirtualNetworkSubnets)

    $Assert.In($subnets, '.', @('AzureBastionSubnet')).ReasonFrom('properties.subnets', $LocalizedData.SubnetNotFound, 'AzureBastionSubnet')

}

# Synopsis: Use Azure Firewall to filter network traffic to and from Azure resources.

Rule 'Azure.VNET.FirewallSubnet' -Ref 'AZR-000322' -Type 'Microsoft.Network/virtualNetworks' -If { HasGatewaySubnet } -Tag @{ release = 'GA'; ruleSet = '2022_12'; 'Azure.WAF/pillar' = 'Security'; } {

    $subnets = @(GetVirtualNetworkSubnets)

    $Assert.In($subnets, '.', @('AzureFirewallSubnet')).ReasonFrom('properties.subnets', $LocalizedData.SubnetNotFound, 'AzureFirewallSubnet')

}

#endregion Virtual Network

#region Helper functions

function global:HasGatewaySubnet {

    [CmdletBinding()]

    [OutputType([System.Boolean])]

    param ()

    process {

        ($TargetObject.Properties.subnets | Where-Object { $_.name -eq 'GatewaySubnet' }) -or

        (@(GetSubResources -ResourceType 'Microsoft.Network/virtualNetworks/subnets' |

            Where-Object { $_.name -eq 'GatewaySubnet' }))

    }

}

function global:GetVirtualNetworkSubnets {

    [CmdletBinding()]

    [OutputType([PSObject])]

    param ()

    process {

        $TargetObject.Properties.subnets | ForEach-Object { $_.name }

        GetSubResources -ResourceType 'Microsoft.Network/virtualNetworks/subnets' | ForEach-Object { $_.name }

    }

}

#endregion Helper functions

# SIG # Begin signature block

# MIIoKQYJKoZIhvcNAQcCoIIoGjCCKBYCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBPzBBJ0zVZRNjt

# qL2O3x1aVrwaIO+667pWtHX6NngvdKCCDXYwggX0MIID3KADAgECAhMzAAADTrU8

# esGEb+srAAAAAANOMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD

# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p

# bmcgUENBIDIwMTEwHhcNMjMwMzE2MTg0MzI5WhcNMjQwMzE0MTg0MzI5WjB0MQsw

# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u

# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB

# AQDdCKiNI6IBFWuvJUmf6WdOJqZmIwYs5G7AJD5UbcL6tsC+EBPDbr36pFGo1bsU

# p53nRyFYnncoMg8FK0d8jLlw0lgexDDr7gicf2zOBFWqfv/nSLwzJFNP5W03DF/1

# 1oZ12rSFqGlm+O46cRjTDFBpMRCZZGddZlRBjivby0eI1VgTD1TvAdfBYQe82fhm

# WQkYR/lWmAK+vW/1+bO7jHaxXTNCxLIBW07F8PBjUcwFxxyfbe2mHB4h1L4U0Ofa

# +HX/aREQ7SqYZz59sXM2ySOfvYyIjnqSO80NGBaz5DvzIG88J0+BNhOu2jl6Dfcq

# jYQs1H/PMSQIK6E7lXDXSpXzAgMBAAGjggFzMIIBbzAfBgNVHSUEGDAWBgorBgEE

# AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUnMc7Zn/ukKBsBiWkwdNfsN5pdwAw

# RQYDVR0RBD4wPKQ6MDgxHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEW

# MBQGA1UEBRMNMjMwMDEyKzUwMDUxNjAfBgNVHSMEGDAWgBRIbmTlUAXTgqoXNzci

# tW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8vd3d3Lm1pY3Jvc29mdC5j

# b20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3JsMGEG

# CCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQu

# Y29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3J0

# MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIBAD21v9pHoLdBSNlFAjmk

# mx4XxOZAPsVxxXbDyQv1+kGDe9XpgBnT1lXnx7JDpFMKBwAyIwdInmvhK9pGBa31

# TyeL3p7R2s0L8SABPPRJHAEk4NHpBXxHjm4TKjezAbSqqbgsy10Y7KApy+9UrKa2

# kGmsuASsk95PVm5vem7OmTs42vm0BJUU+JPQLg8Y/sdj3TtSfLYYZAaJwTAIgi7d

# hzn5hatLo7Dhz+4T+MrFd+6LUa2U3zr97QwzDthx+RP9/RZnur4inzSQsG5DCVIM

# pA1l2NWEA3KAca0tI2l6hQNYsaKL1kefdfHCrPxEry8onJjyGGv9YKoLv6AOO7Oh

# JEmbQlz/xksYG2N/JSOJ+QqYpGTEuYFYVWain7He6jgb41JbpOGKDdE/b+V2q/gX

# UgFe2gdwTpCDsvh8SMRoq1/BNXcr7iTAU38Vgr83iVtPYmFhZOVM0ULp/kKTVoir

# IpP2KCxT4OekOctt8grYnhJ16QMjmMv5o53hjNFXOxigkQWYzUO+6w50g0FAeFa8

# 5ugCCB6lXEk21FFB1FdIHpjSQf+LP/W2OV/HfhC3uTPgKbRtXo83TZYEudooyZ/A

# Vu08sibZ3MkGOJORLERNwKm2G7oqdOv4Qj8Z0JrGgMzj46NFKAxkLSpE5oHQYP1H

# tPx1lPfD7iNSbJsP6LiUHXH1MIIHejCCBWKgAwIBAgIKYQ6Q0gAAAAAAAzANBgkq

# hkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x

# EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv

# bjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5

# IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEwOTA5WjB+MQswCQYDVQQG

# EwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwG

# A1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYDVQQDEx9NaWNyb3NvZnQg

# Q29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC

# CgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+laUKq4BjgaBEm6f8MMHt03

# a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc6Whe0t+bU7IKLMOv2akr

# rnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4Ddato88tt8zpcoRb0Rrrg

# OGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+lD3v++MrWhAfTVYoonpy

# 4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nkkDstrjNYxbc+/jLTswM9

# sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6A4aN91/w0FK/jJSHvMAh

# dCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmdX4jiJV3TIUs+UsS1Vz8k

# A/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL5zmhD+kjSbwYuER8ReTB

# w3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zdsGbiwZeBe+3W7UvnSSmn

# Eyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3T8HhhUSJxAlMxdSlQy90

# lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS4NaIjAsCAwEAAaOCAe0w

# ggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRIbmTlUAXTgqoXNzcitW2o

# ynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYD

# VR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBDuRQFTuHqp8cx0SOJNDBa

# BgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2Ny

# bC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3JsMF4GCCsG

# AQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3dy5taWNyb3NvZnQuY29t

# L3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3J0MIGfBgNV

# HSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEFBQcCARYzaHR0cDovL3d3

# dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1hcnljcHMuaHRtMEAGCCsG

# AQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkAYwB5AF8AcwB0AGEAdABl

# AG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn8oalmOBUeRou09h0ZyKb

# C5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7v0epo/Np22O/IjWll11l

# hJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0bpdS1HXeUOeLpZMlEPXh6

# I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/KmtYSWMfCWluWpiW5IP0

# wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvyCInWH8MyGOLwxS3OW560

# STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBpmLJZiWhub6e3dMNABQam

# ASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJihsMdYzaXht/a8/jyFqGa

# J+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYbBL7fQccOKO7eZS/sl/ah

# XJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbSoqKfenoi+kiVH6v7RyOA

# 9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sLgOppO6/8MO0ETI7f33Vt

# Y5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtXcVZOSEXAQsmbdlsKgEhr

# /Xmfwb1tbWrJUnMTDXpQzTGCGgkwghoFAgEBMIGVMH4xCzAJBgNVBAYTAlVTMRMw

# EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN

# aWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNp

# Z25pbmcgUENBIDIwMTECEzMAAANOtTx6wYRv6ysAAAAAA04wDQYJYIZIAWUDBAIB

# BQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEO

# MAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIAw1u6/xfJdvoJylI1xsgcOI

# SVLWk5jzAqbN2lYxOupdMEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8A

# cwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEB

# BQAEggEAM/K6sHhD+VWrJfBlWFITbCy7XCfIj8Cr2s1qWruchTMT2Y8dt6GWJEgh

# RtmaoMm9W41Uo5LdsZIbTNQIsX5DUlMK6ki0cYjtemlmohhtBzpcYB3v9z71Thcq

# fljJ6IB4SVYYgUAV3rDmCrOdFeieYR2rn9pKUCJLkwnToEGQfkt+eQTsGk/xXT2l

# oVU+/EftvY733X4utRzU4rq1Iul/DGJfD0UFuyCRsp9DRVs0u29OaAeQ0zZvh8At

# I6bQH4ZKloc5Je8PxM3/3/TuV8dx3AT+9Es7SftgKWIjescMGaREEguQsiZZ1CFi

# ZHBTtQARql19wM5no1y8hGEpB+0e/KGCF5MwghePBgorBgEEAYI3AwMBMYIXfzCC

# F3sGCSqGSIb3DQEHAqCCF2wwghdoAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFRBgsq

# hkiG9w0BCRABBKCCAUAEggE8MIIBOAIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFl

# AwQCAQUABCAYuWZwESJH6Aip/AVrrHac/A4Ak5l/SQLg0ZIRKDcTNwIGZQPe2Dl2

# GBIyMDIzMTAwNzEyNTIxOC44NVowBIACAfSggdGkgc4wgcsxCzAJBgNVBAYTAlVT

# MRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQK

# ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJTAjBgNVBAsTHE1pY3Jvc29mdCBBbWVy

# aWNhIE9wZXJhdGlvbnMxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjpBOTM1LTAz

# RTAtRDk0NzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaCC

# EeowggcgMIIFCKADAgECAhMzAAAB0bJbQChsLtJFAAEAAAHRMA0GCSqGSIb3DQEB

# CwUAMHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQH

# EwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNV

# BAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMB4XDTIzMDUyNTE5MTIx

# OFoXDTI0MDIwMTE5MTIxOFowgcsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNo

# aW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29y

# cG9yYXRpb24xJTAjBgNVBAsTHE1pY3Jvc29mdCBBbWVyaWNhIE9wZXJhdGlvbnMx

# JzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjpBOTM1LTAzRTAtRDk0NzElMCMGA1UE

# AxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZTCCAiIwDQYJKoZIhvcNAQEB

# BQADggIPADCCAgoCggIBAJlM2jQ54bPZcV3aAuDmdOUGbxc6m7AkiJewxTrWvCrV

# koOlrjjdGtIb+kfwbPpc2cVAoacKo0K2a+gpQsCnCtP+zv97VfSU0UqaPtTtfinT

# RLS5BtbovBKf/NYdobZznhlewZj4Fh+FYOBsWkJPFHNOdEIbrZuRY+npkdtk+Dge

# 3UJEIAyGE4ZNHzAjgbvDBZnB0xzpS9RSWrSqX0DEB/ORhGmLa1G8Mcx2Zne/Jemq

# EXC9EbxyAIf9NMKNbmrpo1t2oovcEUM/NS24I2w9cvf8TR1HZsMyprRo0f6Ih+EY

# Lj+9zC6144wI9QgNVKoMI18ho8MTBhyLV932C7XNXD4cSENkzsRrefEhSvO35F+n

# lOgwyPhACYnpRp2b5M9sNujyQUgrvRKGZbzCfx8mT1F5BASlO0g3jd5G/1CZfLdR

# 53zSiw4ET5aR0y9IIWH6qAKwp3NDFAkbrZxN6hTZ6o2EfeimlebJ9VTBux59DMw+

# 1uKcJl3QVSWaUz90f7g6eKpDJoe+u1jLfCohp9jfN4UhOVUCg/2r28XhbsodH+4X

# Sa9OkAvk1pMM3WmVBLQx2MySDNkrmC3Co57/etOWoHPHBrthine6s/nJaRPMhIae

# E1Yhk7E7JAg7Fl9uIhsAdubczyGPvcpBZwJHklq+CTBSadwUcRJpB/gOuqz7/UvV

# AgMBAAGjggFJMIIBRTAdBgNVHQ4EFgQUC47xTMXsNwfSaawXhdDHEdC9LaMwHwYD

# VR0jBBgwFoAUn6cVXQBeYl2D9OXSZacbUzUZ6XIwXwYDVR0fBFgwVjBUoFKgUIZO

# aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0JTIw

# VGltZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3JsMGwGCCsGAQUFBwEBBGAwXjBc

# BggrBgEFBQcwAoZQaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0

# cy9NaWNyb3NvZnQlMjBUaW1lLVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcnQwDAYD

# VR0TAQH/BAIwADAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCDAOBgNVHQ8BAf8EBAMC

# B4AwDQYJKoZIhvcNAQELBQADggIBAJu72tMAdXbiZjSqgbl4ScibPlqQZdO+IHAq

# nZjnWzbrDygOtaiv6bTRHj/cFwOZiVQrw2vH9q5gViJ1l11xSPDjZDFJK2a/+pac

# JCL/Y6cffYpUdD6Qw5k8AFBMbVeRydg9Q44QSivp//cmzW6PjCMfMThXhq6ZhcEC

# yvgvkpHy8p6zm0XGEyRY0P87tb9FodjAkyMyTFWiwGiTtXbWwkCXFJwRfF8lr7+q

# SpSvsJmDDdHiMIdGQ+pCExaJtc8xhqv+IXRm4sH07z0Mwk2GMr0FJ/qKqBmgy7Mh

# W34QGhPOm//2njBDrGgEKzb2aSP8QhYV1z7lrfSS4JA5IQ6PTv5Yjb0DiTpAhEHn

# D54yZnQl5zSxLJ5AHkqPETnWJgyG2UytQpyvTqcGoKxIo9ixIAhMDOCywkP5n9xN

# LsK7fl8mtaEz01hfbi4DFgsBbSKk21am0h5XpqS5kR4RXoE20zdVOT6YCVXn94L/

# RjXtpVKMrn+DIOgs2auBXC/lMBoGar/CBFEUeZb1QnfO/wuaTqYigDJOmoFu5SMw

# vKu1qO5KwD+bYOcow7RCLPW/4VJVuozfwn89OWEJNRsU7HSQtPtj/v5nKuKVULPI

# Bh8UiKcMiNaUzzm0N5Txl8kKMUrCrcOxHFXgljXzHDDxNOah3eWSv02oZDngubI9

# Vz7mJs2uMIIHcTCCBVmgAwIBAgITMwAAABXF52ueAptJmQAAAAAAFTANBgkqhkiG

# 9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAO

# BgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEy

# MDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIw

# MTAwHhcNMjEwOTMwMTgyMjI1WhcNMzAwOTMwMTgzMjI1WjB8MQswCQYDVQQGEwJV

# UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE

# ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGlt

# ZS1TdGFtcCBQQ0EgMjAxMDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB

# AOThpkzntHIhC3miy9ckeb0O1YLT/e6cBwfSqWxOdcjKNVf2AX9sSuDivbk+F2Az

# /1xPx2b3lVNxWuJ+Slr+uDZnhUYjDLWNE893MsAQGOhgfWpSg0S3po5GawcU88V2

# 9YZQ3MFEyHFcUTE3oAo4bo3t1w/YJlN8OWECesSq/XJprx2rrPY2vjUmZNqYO7oa

# ezOtgFt+jBAcnVL+tuhiJdxqD89d9P6OU8/W7IVWTe/dvI2k45GPsjksUZzpcGkN

# yjYtcI4xyDUoveO0hyTD4MmPfrVUj9z6BVWYbWg7mka97aSueik3rMvrg0XnRm7K

# MtXAhjBcTyziYrLNueKNiOSWrAFKu75xqRdbZ2De+JKRHh09/SDPc31BmkZ1zcRf

# NN0Sidb9pSB9fvzZnkXftnIv231fgLrbqn427DZM9ituqBJR6L8FA6PRc6ZNN3SU

# HDSCD/AQ8rdHGO2n6Jl8P0zbr17C89XYcz1DTsEzOUyOArxCaC4Q6oRRRuLRvWoY

# WmEBc8pnol7XKHYC4jMYctenIPDC+hIK12NvDMk2ZItboKaDIV1fMHSRlJTYuVD5

# C4lh8zYGNRiER9vcG9H9stQcxWv2XFJRXRLbJbqvUAV6bMURHXLvjflSxIUXk8A8

# FdsaN8cIFRg/eKtFtvUeh17aj54WcmnGrnu3tz5q4i6tAgMBAAGjggHdMIIB2TAS

# BgkrBgEEAYI3FQEEBQIDAQABMCMGCSsGAQQBgjcVAgQWBBQqp1L+ZMSavoKRPEY1

# Kc8Q/y8E7jAdBgNVHQ4EFgQUn6cVXQBeYl2D9OXSZacbUzUZ6XIwXAYDVR0gBFUw

# UzBRBgwrBgEEAYI3TIN9AQEwQTA/BggrBgEFBQcCARYzaHR0cDovL3d3dy5taWNy

# b3NvZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnkuaHRtMBMGA1UdJQQMMAoG

# CCsGAQUFBwMIMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMAsGA1UdDwQEAwIB

# hjAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNX2VsuP6KJcYmjRPZSQW9fO

# mhjEMFYGA1UdHwRPME0wS6BJoEeGRWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9w

# a2kvY3JsL3Byb2R1Y3RzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNybDBaBggr

# BgEFBQcBAQROMEwwSgYIKwYBBQUHMAKGPmh0dHA6Ly93d3cubWljcm9zb2Z0LmNv

# bS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYtMjMuY3J0MA0GCSqGSIb3

# DQEBCwUAA4ICAQCdVX38Kq3hLB9nATEkW+Geckv8qW/qXBS2Pk5HZHixBpOXPTEz

# tTnXwnE2P9pkbHzQdTltuw8x5MKP+2zRoZQYIu7pZmc6U03dmLq2HnjYNi6cqYJW

# AAOwBb6J6Gngugnue99qb74py27YP0h1AdkY3m2CDPVtI1TkeFN1JFe53Z/zjj3G

# 82jfZfakVqr3lbYoVSfQJL1AoL8ZthISEV09J+BAljis9/kpicO8F7BUhUKz/Aye

# ixmJ5/ALaoHCgRlCGVJ1ijbCHcNhcy4sa3tuPywJeBTpkbKpW99Jo3QMvOyRgNI9

# 5ko+ZjtPu4b6MhrZlvSP9pEB9s7GdP32THJvEKt1MMU0sHrYUP4KWN1APMdUbZ1j

# dEgssU5HLcEUBHG/ZPkkvnNtyo4JvbMBV0lUZNlz138eW0QBjloZkWsNn6Qo3GcZ

# KCS6OEuabvshVGtqRRFHqfG3rsjoiV5PndLQTHa1V1QJsWkBRH58oWFsc/4Ku+xB

# Zj1p/cvBQUl+fpO+y/g75LcVv7TOPqUxUYS8vwLBgqJ7Fx0ViY1w/ue10CgaiQuP

# Ntq6TPmb/wrpNPgkNWcr4A245oyZ1uEi6vAnQj0llOZ0dFtq0Z4+7X6gMTN9vMvp

# e784cETRkPHIqzqKOghif9lwY1NNje6CbaUFEMFxBmoQtB1VM1izoXBm8qGCA00w

# ggI1AgEBMIH5oYHRpIHOMIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu

# Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv

# cmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScw

# JQYDVQQLEx5uU2hpZWxkIFRTUyBFU046QTkzNS0wM0UwLUQ5NDcxJTAjBgNVBAMT

# HE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2WiIwoBATAHBgUrDgMCGgMVAEcl

# jYW/4aEtC1ENHa8jMFpK//ssoIGDMIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNV

# BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv

# c29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAg

# UENBIDIwMTAwDQYJKoZIhvcNAQELBQACBQDoy10fMCIYDzIwMjMxMDA3MDQyOTE5

# WhgPMjAyMzEwMDgwNDI5MTlaMHQwOgYKKwYBBAGEWQoEATEsMCowCgIFAOjLXR8C

# AQAwBwIBAAICANUwBwIBAAICE7YwCgIFAOjMrp8CAQAwNgYKKwYBBAGEWQoEAjEo

# MCYwDAYKKwYBBAGEWQoDAqAKMAgCAQACAwehIKEKMAgCAQACAwGGoDANBgkqhkiG

# 9w0BAQsFAAOCAQEAl+KF2/DdGTNO2vjZeF5YcCkbOE7zAgMYJQh1VlGkbopY4nQj

# DNnBp6rqWEJk+1ga6zuIBGu9105f7+HNJrNX6xNfaCkxwTbx0A+CkvbtkENCzqjr

# kwmrJ40jxrPuhDSodWO/uojtfOf8V1gpKnkJTQGafoQ7e/RSnVc7OQYsocBeRcRQ

# xS0xEy1eiEsYqYY5X+0WWk//GWPXd4XOzGAZOJ6JNTTM/BdKKwwltT2enQze7kFD

# gTEn1IwU/3PElM6TIxbFejKICqjY3B5GyL3sYeYxHBEKZq0xehT0yofpiLBi4AXY

# yFRRKxJN31GVbZPsue3o5l2Hu+lcIMpJ6ieHoTGCBA0wggQJAgEBMIGTMHwxCzAJ

# BgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25k

# MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jv

# c29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAAB0bJbQChsLtJFAAEAAAHRMA0G

# CWCGSAFlAwQCAQUAoIIBSjAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwLwYJ

# KoZIhvcNAQkEMSIEICg/O0MH6d3O2UXoFlUCMnGF7ZWDIHP0f9w54aWpIEqhMIH6

# BgsqhkiG9w0BCRACLzGB6jCB5zCB5DCBvQQgzLxheQIAu/ntzmxGGs9O5vWrhPAn

# qhUDfqTwiIj8BwwwgZgwgYCkfjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2Fz

# aGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENv

# cnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAx

# MAITMwAAAdGyW0AobC7SRQABAAAB0TAiBCA7zj9j/ZgFO+TDcEzsVrhbgU3nl/o/

# i2JaPdKUBvYHdzANBgkqhkiG9w0BAQsFAASCAgAND0JPDC3mJoRbQgXZyyYcGc+n

# 83iULLotEY/9bE95r0N4qhVlBgaNo505AOpTorRcbIgNBpvax2n77rlnBY4EnTtk

# 4cAumyW8oUFtiC1DXtMTmDIP+SweF5EIqxwTcQK/3QHA9wOljdoY2+xZjnYYxEf7

# yNWNKnl/fkejl09Pylvfa8q/rglnn2vmzXWnvjRdSvJ2gGDODQkM0JAZCN8DLsbU

# B38FTra6KyIQpUEJABJ4D5zReThxdcVdtSBS7SIqAUgIOo7g9pyFuJFT3miaKTln

# ngKc3SIqFQ6mktXUzB13v3k7cm72ViZG28nlkFBlfjgImpmh5bFxmIWKKFnHhfja

# UC4C7Vj89SVqWabh26A5oXlddzuoWVOJ3lKuDzY6dyufW88Tp5+0e1NsvSPVvzlq

# FHZRk+fDcJqm1qyCU57CSN8ovBDeKKfyDjlC3ren05USyufUpZp7ugEeUJsLQ7Ce

# c5P39N1da4iY0H1qewQliLwEa4kJ3oO526iZyOCH4Z1yxagYqNPt3u+hZG1h0cqU

# YdK1KM+dAf8v4AjrkGzc80x4jo/+UOa5ikXPVGulWMMhLxO405O7T3rBdzVjpNKh

# dXaadEhNojIf8ynsgUzT7Tt/imgJWALByAwDE7aUDmnGPD/KZChglyQiH3qg/LFS

# lerbZNPhYYPjDuFhqQ==

# SIG # End signature block