Policy: Azure > CIS v5.0 > 2 - Analytics Services

This section covers security best practice recommendations for products in the Azure Analytics services category.

Azure Databricks is the primary focus of this section, providing recommendations for secure deployment and configuration of Databricks workspaces.

Primary Policy

This policy is used with the following primary policy:

Azure > CIS v5.0

Controls

Setting this policy configures these controls:

Azure > CIS v5.0 > 2 - Analytics Services > 2.01 - Azure Databricks > 2.01.01 - Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet)
Azure > CIS v5.0 > 2 - Analytics Services > 2.01 - Azure Databricks > 2.01.02 - Ensure that network security groups are configured for Databricks subnets
Azure > CIS v5.0 > 2 - Analytics Services > 2.01 - Azure Databricks > 2.01.03 - Ensure that traffic is encrypted between cluster worker nodes
Azure > CIS v5.0 > 2 - Analytics Services > 2.01 - Azure Databricks > 2.01.04 - Ensure that users and groups are synced from Microsoft Entra ID to Azure Databricks
Azure > CIS v5.0 > 2 - Analytics Services > 2.01 - Azure Databricks > 2.01.05 - Ensure that Unity Catalog is configured for Azure Databricks
Azure > CIS v5.0 > 2 - Analytics Services > 2.01 - Azure Databricks > 2.01.06 - Ensure that usage is restricted and expiry is enforced for Databricks personal access tokens
Azure > CIS v5.0 > 2 - Analytics Services > 2.01 - Azure Databricks > 2.01.07 - Ensure that diagnostic log delivery is configured for Azure Databricks
Azure > CIS v5.0 > 2 - Analytics Services > 2.01 - Azure Databricks > 2.01.08 - Ensure critical data in Azure Databricks is encrypted with customer-managed keys (CMK)
Azure > CIS v5.0 > 2 - Analytics Services > 2.01 - Azure Databricks > 2.01.09 - Ensure 'No Public IP' is set to 'Enabled'
Azure > CIS v5.0 > 2 - Analytics Services > 2.01 - Azure Databricks > 2.01.10 - Ensure 'Allow Public Network Access' is set to 'Disabled'
Azure > CIS v5.0 > 2 - Analytics Services > 2.01 - Azure Databricks > 2.01.11 - Ensure private endpoints are used to access Azure Databricks workspaces
Azure > CIS v5.0 > 5 - Identity Services > 5.02 - Conditional Access > 5.02.01 - Ensure that 'trusted locations' are defined

Policy Specification

Schema Type	`string`
Default	`Per Azure > CIS v5.0`
Valid Values [YAML]	`Per Azure > CIS v5.0` `Skip` `Check: All CIS Benchmarks except attestations` `Check: All CIS Benchmarks`
Examples [YAML]	`Skip`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/cis#/control/categories/cis

Policy Type URI

tmod:@turbot/azure-cisv5-0#/policy/types/s02

GraphQL

query policyType(id: "tmod:@turbot/azure-cisv5-0#/policy/types/s02") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/azure-cisv5-0#/policy/types/s02'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/azure-cisv5-0#/policy/types/s02'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/azure-cisv5-0#/policy/types/s02"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/azure-cisv5-0#/policy/types/s02"