You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: Docs/integrating-with-alz-library.md
+29-8Lines changed: 29 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -89,7 +89,7 @@ Carefully review the generated policy assigments and ensure all parameter and sc
89
89
90
90
2. When complete run `Build-DeploymentPlans` to ensure the correct changes are made. During the first sync for either a new or existing environment there will be many changes due to updating of the existing policies.
For users interested in deploying the [Azure Monitor Baseline Alerts](https://azure.github.io/azure-monitor-baseline-alerts/welcome/) project with EPAC - these policies have been extracted and converted to the EPAC format and are available at the [amba-export](https://github.com/anwather/amba-export) repository.
107
107
108
+
> [!Note]
109
+
> Review breaking changes on the [AMBA Releases](https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/HowTo/UpdateToNewReleases/) page to ensure policy deployments. In most cases, it's an update of a parameter type (i.e. String -> Array).
110
+
108
111
```ps1
109
-
# Create a Pac Environment default file for ALZ policies using the latest version of the ALZ Library
112
+
# Create a Pac Environment default file for AMBA policies using the latest version of the ALZ Library
For users interested in deploying the [Sovereignty Policy Baseline](https://github.com/Azure/sovereign-landing-zone/blob/main/docs/scenarios/Sovereignty-Baseline-Policy-Initiatives.md) project with EPAC - these policies have been extracted and converted to the EPAC format and are available at the [spb-export](https://github.com/anwather/spb-export) repository.
119
122
120
123
```ps1
121
-
# Create a Pac Environment default file for ALZ policies using the latest version of the ALZ Library
2. When syncing policies run the `Sync-ALZPolicyFromLibrary` once for each PAC Environment. A folder specific for that Pac Selector will now be placed within the ALZ Type.
150
153
154
+
### Disabling / Changes specific parameters
155
+
156
+
If you need to disable a single policy parameter, such as the 'effect' for a specific Defender for Cloud, add that specific parameter to your default file structure to ensure it does not get overwritten when running the **Sync-ALZPolicyFromLibrary** command.
157
+
158
+
An example of disabling the **"Configure Microsoft Defender for Key Vault plan"** in the **"Deploy-MDFC-Config-H224"** Policy Assignment.
159
+
160
+
```json
161
+
"enableAscForKeyVault_effect": {
162
+
"policy_assignment_name": [
163
+
"Deploy-MDFC-Config-H224"
164
+
],
165
+
"description": "Enable or disable the execution of the Key Vault DFC policy.",
166
+
"parameters": {
167
+
"parameter_name": "enableAscForKeyVault",
168
+
"value": "Disabled"// Update the value here as required by the description
Copy file name to clipboardExpand all lines: Docs/policy-assignments-csv-parameters.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,7 +25,7 @@ In the example header below the infrastructure environments prod, test, dev, and
25
25
The CSV file generated contains the following headers/columns:
26
26
27
27
*`name` is the name of the policyDefinition referenced by the Policy Sets being assigned.
28
-
*`referencePath` is only used if the Policy is used more than once in at least one of the Policy Sets to disambiguate them. The format is `<policySetName>\\<policyDefinitionReferenceId>`.
28
+
*`referencePath` is only used if the Policy is used more than once in at least one of the Policy Sets to disambiguate them. The format is `<policySetName>//<policyDefinitionReferenceId>`.
29
29
*`policyType`,`category`,`displayName`,`description`,`groupNames`,`policySets`,`allowedEffects` are optional and not used for deployment planning. They assist you in filling out the `<env>Effect` columns. The CSV file is sorted alphabetically by `category` and `displayName`.
30
30
*`<env>Effect` columns must contain one of the allowedValues or allowedOverrides values. You define which scopes define each type of environment and what short name you give the environment type to use as a column prefix.
31
31
*`<env>Parameters` can contain additional parameters. You can also specify such parameters in JSON. EPAC will use the union of all parameters.
Copy file name to clipboardExpand all lines: Docs/policy-assignments.md
+64Lines changed: 64 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,6 +3,70 @@
3
3
4
4
This chapter describes how **Policy Assignments** are handled by EPAC. Policy Assignments are the actual assignments of Policies and Policy Sets to scopes in Azure.
5
5
6
+
## Templates
7
+
8
+
### Single Scope
9
+
10
+
Recommended for simple deployments to a single scope.
Assignment JSON is hierarchical for efficient definitions, avoiding duplication (copy/paste) of JSON. Each branch of the tree is cumulative. Each tree node must include a `nodeName` - an arbitrary string exclusively used by EPAC to display an error location. EPAC concatenates a leading `/` and the nodeName entries encountered in the tree to create a "breadcrumbs" trail; therefore, we recommend that you use `/` to help separate the concatenated `nodeName`. The following partial and invalid assignment tree would create this error message.
Copy file name to clipboardExpand all lines: Docs/policy-definitions.md
+41-47Lines changed: 41 additions & 47 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,49 +6,11 @@ Policy definition files are managed within the folder `policyDefinitions` under
6
6
7
7
The names of the definition JSON files don't matter, the Policy and Policy Set definitions are registered based on the `name` attribute. The solution also allows the use of JSON with comments by using `.jsonc` instead of `.json` for the file extension.
8
8
9
-
### Custom Definitions
10
-
11
-
Custom definitions are uploaded to Azure at the time of initial deployment to a pacSelector. For each pacSelector, the definition is uploaded to the pacSelector's defined root. This makes it available to the entirity of that pacSelector, while facilitating code promotion by allowing each pacSelector to recieve the updated definition as part of the release/deployment process.
12
-
13
-
### Definition Delivery
14
-
15
-
[policy(Set)Definitions](https://learn.microsoft.com/en-us/azure/governance/policy/concepts/scope#definition-location) are deployed at the pacSelector root. This enables versioning on custom definitions to be put through the CI/CD based change process.
16
-
17
-
## JSON Schema
18
-
19
-
The GitHub repo contains a JSON schema which can be used in tools such as [VS Code](https://code.visualstudio.com/Docs/languages/json#_json-schemas-and-settings) to provide code completion.
20
-
21
-
To utilize the schema add a ```$schema``` tag to the JSON file.
This schema is new in v7.4.x and may not be complete. Please let us know if we missed anything.
30
-
31
-
## Recommendations
32
-
33
-
*`"name"` is required and should be unique. It can be a GUID or a unique short name.
34
-
*`"category"` should be one of the standard ones defined in built-in Policies.
35
-
* Do not specify an `id`. The solution will ignore it.
36
-
* Make the `effect` parameterized. Always use the parameter name `effect`.
37
-
* Whenever feasible, provide a `defaultValue` for parameters, especially for the `effect` parameter.
38
-
* Policy aliases are used by Azure Policy to refer to resource type properties in the `if` condition and in `existenceCondition`: <https://docs.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure#aliases>.
39
-
40
-
## Metadata
41
-
42
-
It is customary to include a `category` and a `version` in the `metadata` section. The `category` should be one of the standard ones defined in built-in Policies. The `version` should be a semantic version number.
43
-
44
-
EPAC injects `deployedBy` into the `metadata` section. This is a string that identifies the deployment source. It defaults to `epac/$pacOwnerId/$pacSelector`. You can override this value in `global-settings.jsonc`
45
-
46
-
**Not recommended:** Adding `deployedBy` to the `metadata` section in the Policy definition file will override the value for this definition only from `global-settings.jsonc` or default value.
@@ -72,13 +34,6 @@ EPAC injects `deployedBy` into the `metadata` section. This is a string that ide
72
34
"Disabled"
73
35
],
74
36
"defaultValue": "Audit"
75
-
},
76
-
"YourParameter": {
77
-
"type": "String",
78
-
"metadata": {
79
-
"displayName": "YourParameter",
80
-
"description": "Your Parameter Description"
81
-
}
82
37
}
83
38
},
84
39
"policyRule": {
@@ -92,3 +47,42 @@ EPAC injects `deployedBy` into the `metadata` section. This is a string that ide
92
47
}
93
48
}
94
49
```
50
+
51
+
### Custom Definitions
52
+
53
+
Custom definitions are uploaded to Azure at the time of initial deployment to a pacSelector. For each pacSelector, the definition is uploaded to the pacSelector's defined root. This makes it available to the entirity of that pacSelector, while facilitating code promotion by allowing each pacSelector to recieve the updated definition as part of the release/deployment process.
54
+
55
+
### Definition Delivery
56
+
57
+
[policy(Set)Definitions](https://learn.microsoft.com/en-us/azure/governance/policy/concepts/scope#definition-location) are deployed at the pacSelector root. This enables versioning on custom definitions to be put through the CI/CD based change process.
58
+
59
+
## JSON Schema
60
+
61
+
The GitHub repo contains a JSON schema which can be used in tools such as [VS Code](https://code.visualstudio.com/Docs/languages/json#_json-schemas-and-settings) to provide code completion.
62
+
63
+
To utilize the schema add a ```$schema``` tag to the JSON file.
This schema is new in v7.4.x and may not be complete. Please let us know if we missed anything.
72
+
73
+
## Recommendations
74
+
75
+
*`"name"` is required and should be unique. It can be a GUID or a unique short name.
76
+
*`"category"` should be one of the standard ones defined in built-in Policies.
77
+
* Do not specify an `id`. The solution will ignore it.
78
+
* Make the `effect` parameterized. Always use the parameter name `effect`.
79
+
* Whenever feasible, provide a `defaultValue` for parameters, especially for the `effect` parameter.
80
+
* Policy aliases are used by Azure Policy to refer to resource type properties in the `if` condition and in `existenceCondition`: <https://docs.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure#aliases>.
81
+
82
+
## Metadata
83
+
84
+
It is customary to include a `category` and a `version` in the `metadata` section. The `category` should be one of the standard ones defined in built-in Policies. The `version` should be a semantic version number.
85
+
86
+
EPAC injects `deployedBy` into the `metadata` section. This is a string that identifies the deployment source. It defaults to `epac/$pacOwnerId/$pacSelector`. You can override this value in `global-settings.jsonc`
87
+
88
+
**Not recommended:** Adding `deployedBy` to the `metadata` section in the Policy definition file will override the value for this definition only from `global-settings.jsonc` or default value.
Copy file name to clipboardExpand all lines: Docs/policy-exemptions.md
+29Lines changed: 29 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,6 +3,35 @@
3
3
> [!TIP]
4
4
> The changes implementing [Option **A** below](#option-a-policy-definition-ids-or-names) makes JSON files easier to read than CSV files. We recommend using **Policy definition Ids or Names** for new exemptions and **JSON** files instead of CSV files. Of course, CSV files are still supported. You may even mix and match the two formats in the same folder.
5
5
6
+
## Templates
7
+
8
+
### JSON
9
+
10
+
```json
11
+
{
12
+
"exemptions": [
13
+
{
14
+
"name": "short-name",
15
+
"displayName": "Descriptive name displayed on portal",
Exemptions can be defined as JSON or CSV files (we recommend that you use JSON files). The names of the definition files don't matter. If multiple files exists in a folder, the lists from all the files are added together.
0 commit comments