Policy Packs

guardrails-samples

This section covers security recommendations to follow to set general database services policies on an Azure Subscription. Subsections will address specific database types.

Azure CIS v2.0.0 - Section 4 - Database Services

main

azure_cosmosdb_database_account_firewall

Configure the firewall settings required for `Azure &gt; Cosmos DB &gt; Database Account`.&#92;n&#92;nAzure Cosmos DB provides a layered security model. It enables you to secure and control the level of access to your database accounts that your applications and enterprise environments demand, based on the type and subset of networks used.&#92;n

databaseAccountFirewall

Azure > Cosmos DB > Database Account > Firewall

azure_cosmosdb_database_account_firewall_ip_ranges_required

Configure database accounts to allow access from specific public internet IP address ranges. This policy grants access to approved internet address ranges or individual IP addresses and blocks unapproved internet traffic.&#92;n&#92;nIf set to `Enforce: Required &gt; Items`, this policy will grant access to the IP ranges in Required &gt; Items.&#92;n

databaseAccountFirewallIpRangesRequired

Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required

azure_cosmosdb_database_account_firewall_ip_ranges_required_items

Configure database accounts to allow access from specific public internet IP address ranges. This configuration grants access to specific internet-based services and on-premises networks and blocks general internet traffic.&#92;n&#92;nProvide allowed internet address ranges using CIDR notation in the form 16.17.18.0/24 or as individual IP addresses like 16.17.18.19.&#92;n&#92;nSmall address ranges using &quot;/31&quot; or &quot;/32&quot; prefix sizes are not supported. These ranges should be configured using individual IP address rules.&#92;n&#92;nIP network rules are only allowed for public internet IP addresses. IP address ranges reserved for private networks (as defined in RFC 1918) aren&#39;t allowed in IP rules. Private networks include addresses that start with 10.*, 172.16.* - 172.31.*, and 192.168.*.&#92;n&#92;nExample:&#92;n  - ipAddressOrRange: 45.127.45.223&#92;n  - ipAddressOrRange: 223.235.113.55&#92;n  - ipAddressOrRange: 45.64.0.0/10&#92;n

databaseAccountFirewallIpRangesRequiredItems

Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required > Items

azure_cosmosdb_database_account_firewall_virtual_networks_required

Configure database accounts to allow access from specific virtual networks. This policy grants access to approved virtual networks and blocks unapproved internet traffic.&#92;n&#92;nIf set to `Enforce: Required &gt; Items`, this policy will grant access to the subnets in Required &gt; Items.&#92;n

databaseAccountFirewallVirtualNetworksRequired

Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required

azure_cosmosdb_database_account_firewall_virtual_networks_required_items

Configure database accounts to allow access only from specific subnets. The allowed subnets may belong to a virtual network in the same subscription, or those in a different subscription, including subscriptions belonging to a different Azure Active Directory tenant. This policy grants access to approved virtual networks.&#92;n

databaseAccountFirewallVirtualNetworksRequiredItems

Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required > Items

azure_mysql_flexible_server_encryption_in_transit

Define the Encryption in Transit settings required for `Azure &gt; MySQL &gt; Flexible Server`.&#92;n&#92;nThe Encryption in Transit control compares the Encryption in Transit settings against the Encryption in Transit policies for the resource (Azure &gt; MySQL &gt; Flexible Server &gt; Encryption in Transit), raises an alarm, and takes the defined enforcement action.&#92;n

flexibleServerEncryptionInTransit

Azure > MySQL > Flexible Server > Encryption in Transit

azure_mysql_flexible_server_minimum_tls_version

Define the Minimum TLS Version setting required for `Azure &gt; MySQL &gt; Flexible Server`.&#92;n

flexibleServerMinimumTlsVersion

Azure > MySQL > Flexible Server > Minimum TLS Version

azure_mysql_server_encryption_in_transit

Define the Encryption in Transit settings required for `Azure &gt; MySQL &gt; Server`.&#92;n&#92;nThe Encryption in Transit control compares the Encryption in Transit settings against the Encryption in Transit policies for the resource&#92;n(Azure &gt; MySQL &gt; Server &gt; Encryption in Transit), raises an alarm, and takes the defined enforcement action&#92;n

serverEncryptionInTransit

Azure > MySQL > Server > Encryption in Transit

azure_network_network_security_group_ingress_rules_approved

Configure Network Security Group Ingress Rule checking. This policy defines whether&#92;nto verify the security group ingress rules are approved, as well as the&#92;nsubsequent action to take on unapproved items. Rules for all `Approved`&#92;npolicies will be compiled in `Approved &gt; Compiled Rules` and then&#92;nevaluated.&#92;n&#92;nIf set to `Enforce: Delete unapproved`, any unapproved rules will be&#92;nrevoked from the security group.&#92;n

networkSecurityGroupIngressRulesApproved

Azure > Network > Network Security Group > Ingress Rules > Approved

azure_network_network_security_group_ingress_rules_approved_rules

An [Object Control List (OCL)](https://turbot.com/guardrails/docs/reference/ocl)&#92;nwith a list of filter rules to approve or reject security group rules.&#92;n&#92;nNote that the Approved control does not operate directly from this policy,&#92;nbut from the `Approved &gt; Compiled Rules`. The rules are processed in order,&#92;nand any built-in Guardrails rules will appear first in the list of compiled&#92;nrules.&#92;n&#92;nExamples:&#92;n  ```&#92;n  Allow HTTP and HTTPS rules for RFC1918 private space&#92;n  APPROVE $.turbot.fromPort:=80 $.turbot.toPort:=80 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16&#92;n  APPROVE $.turbot.fromPort:=443 $.turbot.toPort:=443 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16&#92;n&#92;n  Allow all rules from security groups in this account&#92;n  APPROVE $.UserIdGroupPairs.+.UserId:&quot;969297701313&quot;&#92;n&#92;n  Reject any rule from 0.0.0.0/0&#92;n  REJECT $.turbot.cidr:0.0.0.0/0&#92;n  ```&#92;n

networkSecurityGroupIngressRulesApprovedRules

Azure > Network > Network Security Group > Ingress Rules > Approved > Rules

azure_postgresql_flexible_server_audit_logging

Determine whether to check or enforce Audit Logging settings for the Azure PostgreSQL Flexible Server.&#92;n

flexibleServerAuditLogging

Azure > PostgreSQL > Flexible Server > Audit Logging

azure_postgresql_flexible_server_audit_logging_log_checkpoints

Set the desired value for the PostgreSQL Flexible Server log_checkpoints parameter.&#92;n

flexibleServerAuditLoggingLogCheckpoints

Azure > PostgreSQL > Flexible Server > Audit Logging > Log Checkpoints

azure_postgresql_flexible_server_encryption_in_transit

Define the Encryption in Transit settings required for `Azure &gt; PostgreSQL &gt; Flexible Server`.&#92;n&#92;nThe Encryption in Transit control compares the Encryption in Transit settings against the Encryption in Transit policies for the resource (Azure &gt; PostgreSQL &gt; Flexible Server &gt; Encryption in Transit), raises an alarm, and takes the defined enforcement action.&#92;n

Azure > PostgreSQL > Flexible Server > Encryption in Transit

azure_postgresql_server_approved

Determine the action to take when an Azure PostgreSQL server is not approved based on `Azure &gt; PostgreSQL &gt; Server &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

serverApproved

Azure > PostgreSQL > Server > Approved

azure_postgresql_server_approved_custom

Determine whether the Azure PostgreSQL server is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If an Azure PostgreSQL server is not approved, it will be subject to the action specified in the `Azure &gt; PostgreSQL &gt; Server &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

serverApprovedCustom

Azure > PostgreSQL > Server > Approved > Custom

azure_postgresql_server_audit_logging

Determine whether to check or enforce Audit Logging settings&#92;nfor the Azure PostgreSQL Server.&#92;n

serverAuditLogging

Azure > PostgreSQL > Server > Audit Logging

azure_postgresql_server_audit_logging_connection_throttling

Set the Desired Value for the PostgreSQL connection_throttling parameter.&#92;n

serverAuditLoggingConnectionThrottling

Azure > PostgreSQL > Server > Audit Logging > Connection Throttling

azure_postgresql_server_audit_logging_log_checkpoints

Set the desired value for the PostgreSQL log_checkpoints parameter.&#92;n

serverAuditLoggingLogCheckpoints

Azure > PostgreSQL > Server > Audit Logging > Log Checkpoints

azure_postgresql_server_audit_logging_log_connections

Set the Desired Value for the PostgreSQL log_connections parameter.&#92;n

serverAuditLoggingLogConnections

Azure > PostgreSQL > Server > Audit Logging > Log Connections

azure_postgresql_server_audit_logging_log_disconnections

Set the Desired Value for the PostgreSQL log_disconnections parameter.&#92;n

serverAuditLoggingLogDisconnections

Azure > PostgreSQL > Server > Audit Logging > Log Disconnections

azure_postgresql_server_audit_logging_log_retention_days

Set the Desired Value for the PostgreSQL log_retention_days parameter.&#92;n

serverAuditLoggingLogRetentionDays

Azure > PostgreSQL > Server > Audit Logging > Log Retention Days

azure_postgresql_server_encryption_in_transit

Define the Encryption in Transit settings required for `Azure &gt; PostgreSQL &gt; Server`.&#92;n&#92;nThe Encryption in Transit control compares the Encryption in Transit settings against the Encryption in Transit policies for the resource&#92;n(Azure &gt; PostgreSQL &gt; Server &gt; Encryption in Transit), raises an alarm, and takes the defined enforcement action&#92;n

Azure > PostgreSQL > Server > Encryption in Transit

azure_sql_database_encryption_at_rest

Define the Encryption at Rest settings required for `Azure &gt; SQL &gt; Database`.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written&#92;nto an underlying storage system. This control determines whether the resource&#92;nis encrypted at rest, and sets encryption.&#92;n&#92;nThe Encryption at Rest control compares the encryption settings against the&#92;nencryption policies for the resource&#92;n(`Azure &gt; SQL &gt; Database &gt; Encryption at Rest`),&#92;nraises an alarm, and takes the defined enforcement action.&#92;n

databaseEncryptionAtRest

Azure > SQL > Database > Encryption at Rest

azure_sql_server_active_directory_administrator

Define the Active Directory Administrator settings required for `Azure &gt; SQL &gt; Server`.&#92;n&#92;nThe Active Directory Administrator policy determines what should be the active directory authentication value set for Azure SQL Server.&#92;n&#92;nEnabling active directory authentication on a SQL server permits you to centrally manage identity and access Azure SQL Database.&#92;n

serverActiveDirectoryAdministrator

Azure > SQL > Server > Active Directory Administrator

azure_sql_server_active_directory_administrator_name

Define the Azure Active Directory resource display name or object ID for `Azure &gt; SQL &gt; Server &gt; Active Directory Administrator` policy.&#92;n&#92;nActive Directory Authentication for SQL Server supports Active Directory User, Application, Group any one of them at a time.&#92;n&#92;nPlease make sure the value given is the valid Display Name or the ObjectID of the desired resource you want to use.&#92;n```&#92;nexample:&#92;n  ddc06e04-ce5f-4995-c758-c2b6c510e8fd&#92;n  d8831d9d-8756-4dd9-83e0-d8ce58525496&#92;n  organizationuser@organizationwebsite.onmicrosoft.com&#92;n  azureAD-dev-application&#92;n  projectDevelopersGroup&#92;n```&#92;n

serverActiveDirectoryAdministratorName

Azure > SQL > Server > Active Directory Administrator > Name

azure_sql_server_auditing

Define the auditing settings required for `Azure &gt; SQL &gt; Server`.&#92;n&#92;nAuditing for Azure SQL Server tracks server events and writes them to an audit log&#92;nin your Azure Storage account, Log Analytics workspace or Event Hubs. This control&#92;ndetermines whether the resource auditing is set to your desired Azure Storage account with desired&#92;nretention days.&#92;n&#92;nAn auditing policy can be defined for a specific database or as a default server policy. A server policy&#92;napplies to all existing and newly created databases on the server. Azure recommends to enable only server-level&#92;nblob auditing and leave the database-level auditing disabled for all databases.&#92;n&#92;nThe Auditing control compares the auditing settings against the auditing policies for the resource&#92;n(Azue &gt; SQL &gt; Server &gt; Auditing &gt; *), raises an alarm, and takes the defined enforcement action&#92;n

serverAuditing

Azure > SQL > Server > Auditing

azure_sql_server_auditing_retention_days

Define the number of days to keep in the audit logs in the storage account.&#92;n&#92;n_Note_: Setting the policy to `0` will set the retention to infinity.&#92;n

serverAuditingRetentionDays

Azure > SQL > Server > Auditing > Retention Days

azure_sql_server_auditing_storage_account

Define the storage account for server audit logs.&#92;n&#92;nThe storage account name or primary blob endpoint is required.&#92;n&#92;nPremium storage and hierarchical namespace for Azure Data Lake Storage Gen2&#92;nstorage account is currently not supported.&#92;n&#92;nany of these examples are valid:&#92;n```&#92;n  teststorageaccount&#92;n  https://teststorageaccount.blob.core.windows.net/&#92;n  https://teststorageaccount.blob.core.usgovcloudapi.net/&#92;n  https://teststorageaccount.blob.core.chinacloudapi.cn/&#92;n```&#92;n_Note_: To avoid cross-region reads/writes of audit records, Azure highly recommends to use storage and server located in the same region.&#92;n

serverAuditingStorageAccount

Azure > SQL > Server > Auditing > Storage Account

azure_sql_server_data_security

Define the advanced data security settings required for `Azure &gt; SQL &gt; Server`.&#92;n&#92;nAdvanced data security for SQL Server includes functionality for surfacing and mitigating potential database&#92;nvulnerabilities and detecting anomalous activities that could indicate a threat to your server. The Advanced&#92;ndata security package provides administrators with a single go-to location for discovering and classifying data,&#92;nassessing and addressing potential database vulnerabilities, and visibility into anomalous and potentially malicious&#92;nactivity that is taking place.&#92;n&#92;nAdvanced data security can be defined for a specific database or as a default server policy. A server policy&#92;napplies to all existing and newly created databases on the server. Azure recommends to enable only server-level&#92;ndata security and leave the database-level data security disabled for all databases.&#92;n&#92;nThe Advanced data security control compares the vulnerability assessment and threat protection settings against&#92;nthe advanced data security policies for the resource (Azue &gt; SQL &gt; Server &gt; Advanced Data Security &gt; *),&#92;nraises an alarm, and takes the defined enforcement action.&#92;n

serverDataSecurity

Azure > SQL > Server > Advanced Data Security

azure_sql_server_threat_protection_email_addresses

Define the email addresses to receive an email notification upon detection of anomalous database activities.&#92;n&#92;nThe email provides information on the suspicious security event including the nature of the anomalous activities,&#92;ndatabase name, server name, application name, and the event time. In addition, the email provides information on&#92;npossible causes and recommended actions to investigate and mitigate the potential threat to the database.&#92;n

serverThreatProtectionEmailAddresses

Azure > SQL > Server > Advanced Data Security > Threat Protection > Email Addresses

azure_sql_server_threat_protection_notify_admins

Notify account administrators upon detection of anomalous database activities.&#92;n&#92;nThe email provides information on the suspicious security event including the nature of the anomalous activities,&#92;ndatabase name, server name, application name, and the event time. In addition, the email provides information&#92;non possible causes and recommended actions to investigate and mitigate the potential threat to the database.&#92;n

serverThreatProtectionNotifyAdmins

Azure > SQL > Server > Advanced Data Security > Threat Protection > Notify Admins

azure_sql_server_threat_protection_types

Define the threat protection types for Azure SQL server.&#92;n&#92;nAdvanced threat protection for the Azure SQL server detects anomalous activities&#92;nindicating unusual and potentially harmful attempts to access or exploit databases and it can&#92;ntrigger the following alerts.&#92;n

serverThreatProtectionTypes

Azure > SQL > Server > Advanced Data Security > Threat Protection > Types

azure_sql_server_vulnerability_assessment_email_addresses

Define the email addresses to receive an email notification of scan result summary.&#92;n

serverVulnerabilityAssessmentEmailAddresses

Azure > SQL > Server > Advanced Data Security > Vulnerability Assessment > Periodic Scans > Email Addresses

azure_sql_server_vulnerability_assessment_notify_admins

Define if the schedule scan notification will be sent to the subscription administrators and owners.

serverVulnerabilityAssessmentNotifyAdmins

Azure > SQL > Server > Advanced Data Security > Vulnerability Assessment > Periodic Scans > Notify Admins

azure_sql_server_vulnerability_assessment_periodic_scan

Periodic recurring scan setting configures vulnerability assessment to automatically run a scan on your database once per week.&#92;n

serverVulnerabilityAssessmentPeriodicScans

Azure > SQL > Server > Advanced Data Security > Vulnerability Assessment > Periodic Scans

azure_sql_server_vulnerability_assessment_storage_account

Define the storage account where scan results for all databases on the server will be stored.&#92;n&#92;nThe storage account name is required.&#92;nIf the container name is not specified, then `vulnerability-assessment` is taken as default.&#92;n&#92;nexample:&#92;n```&#92;n  - teststorageaccount&#92;n  - teststorageaccount/containername&#92;n&#92;n```&#92;n_Note_: To avoid cross-region reads/writes of audit records, Azure highly recommends to use storage and server located in the same region.&#92;n