Turbot Guardrails Hub 
Hub
  • Mods
  • Policy Packs
  • Docs
  • Home
ModsPolicy PacksDocsHome
Mods
Azure
Loading policies...

Policy: Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.05 - Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production Workloads)

Configures auditing against a CIS Benchmark item.

Level: 2

The use of Basic or Free SKUs in Azure whilst cost effective have significant limitations in terms of what can be monitored and what support can be realized from Microsoft. Typically, these SKU's do not have a service SLA and Microsoft may refuse to provide support for them. Consequently Basic/Free SKUs should never be used for production workloads.

Typically, production workloads need to be monitored and should have an SLA with Microsoft, using Basic SKUs for any deployed product will mean that that these capabilities do not exist. The following resource types should use standard SKUs as a minimum: - Public IP Addresses - Network Load Balancers - REDIS Cache - SQL PaaS Databases - VPN Gateways

Targets

This policy targets the following resource types:

  • Azure > Load Balancer > Load Balancer
  • Azure > Network > Public IP Address
  • Azure > Network > Virtual Network Gateway
  • Azure > SQL > Database

Primary Policy

This policy is used with the following primary policy:

  • Azure > CIS v3.0 > 06 - Logging & Monitoring

Controls

Setting this policy configures this control:

  • Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.05 - Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production Workloads)

Policy Specification

Schema Type
string
Default
Per Azure > CIS v3.0 > 06 - Logging & Monitoring
Valid Values [YAML]
  • Per Azure > CIS v3.0 > 06 - Logging & Monitoring
    
  • Skip
    
  • Check: Benchmark
    

Category

  • CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers > 5.05 Implement Automated Configuration Monitoring Systems

In Your Workspace

  • Policy Settings by Type report

Developers

    Category URI
    • tmod:@turbot/cis#/control/categories/v070505
  • Policy Type URI
    • tmod:@turbot/azure-cisv3-0#/policy/types/r0605
  • GraphQL
    • query policyType(id: "tmod:@turbot/azure-cisv3-0#/policy/types/r0605") { … }
    • query policySettings(filter: "policyTypeId:'tmod:@turbot/azure-cisv3-0#/policy/types/r0605'") { … }
    • query policyValues(filter: "policyTypeId:'tmod:@turbot/azure-cisv3-0#/policy/types/r0605'") { … }
  • CLI
    • Get Policy Type
    • turbot graphql policy-type --id "tmod:@turbot/azure-cisv3-0#/policy/types/r0605"
    • Get Policy Settings
    • turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/azure-cisv3-0#/policy/types/r0605"
Guardrails
Guardrails Hub
  • Hub
  • Docs
  • Blog
  • Changelog
Products
  • GuardrailsGuardrails
  • PipesPipes
  • SteampipeSteampipe
  • PowerpipePowerpipe
  • FlowpipeFlowpipe
  • TailpipeTailpipe
Turbot
  • Home
  • About us
  • We're hiring!
  • Contact us
Community

Our community of practitioners love to discuss cloud governance & security.

Slack logoJoin us on Slack →

System StatusLegalSecurity
Terms of UseSecurityPrivacy
50
Mods
204
Resource Types
3,575
Policies
1,941
Controls
103
Quick Actions
111
IAM