Policy Packs

guardrails-samples

This section covers security recommendations to follow in order to set networking policies on an Azure subscription.

Azure CIS v2.0.0 - Section 6 - Networking

main

azure_network_network_security_group_ingress_rules_approved

Configure Network Security Group Ingress Rule checking. This policy defines whether&#92;nto verify the security group ingress rules are approved, as well as the&#92;nsubsequent action to take on unapproved items. Rules for all `Approved`&#92;npolicies will be compiled in `Approved &gt; Compiled Rules` and then&#92;nevaluated.&#92;n&#92;nIf set to `Enforce: Delete unapproved`, any unapproved rules will be&#92;nrevoked from the security group.&#92;n

networkSecurityGroupIngressRulesApproved

Azure > Network > Network Security Group > Ingress Rules > Approved

azure_network_network_security_group_ingress_rules_approved_rules

An [Object Control List (OCL)](https://turbot.com/guardrails/docs/reference/ocl)&#92;nwith a list of filter rules to approve or reject security group rules.&#92;n&#92;nNote that the Approved control does not operate directly from this policy,&#92;nbut from the `Approved &gt; Compiled Rules`. The rules are processed in order,&#92;nand any built-in Guardrails rules will appear first in the list of compiled&#92;nrules.&#92;n&#92;nExamples:&#92;n  ```&#92;n  Allow HTTP and HTTPS rules for RFC1918 private space&#92;n  APPROVE $.turbot.fromPort:=80 $.turbot.toPort:=80 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16&#92;n  APPROVE $.turbot.fromPort:=443 $.turbot.toPort:=443 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16&#92;n&#92;n  Allow all rules from security groups in this account&#92;n  APPROVE $.UserIdGroupPairs.+.UserId:&quot;969297701313&quot;&#92;n&#92;n  Reject any rule from 0.0.0.0/0&#92;n  REJECT $.turbot.cidr:0.0.0.0/0&#92;n  ```&#92;n

networkSecurityGroupIngressRulesApprovedRules

Azure > Network > Network Security Group > Ingress Rules > Approved > Rules

azure_network_watcher_approved

Determine the action to take when an Azure Network Watcher network watcher is not approved based on `Azure &gt; Network Watcher &gt; Network Watcher &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

networkWatcherApproved

Azure > Network Watcher > Network Watcher > Approved

azure_network_watcher_approved_custom

Determine whether the Azure Network Watcher network watcher is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If an Azure Network Watcher network watcher is not approved, it will be subject to the action specified in the `Azure &gt; Network Watcher &gt; Network Watcher &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

networkWatcherApprovedCustom

Azure > Network Watcher > Network Watcher > Approved > Custom

azure_networkwatcher_flow_log_retention_policy

Raise an alarm if the network security group flow log retention policy is not configured to meet policy.&#92;n&#92;n**Note:** This check applies exclusively to flow logs using V2 storage accounts.&#92;n

flowLogRetentionPolicy

Azure > Network Watcher > Flow Log > Retention Policy

azure_networkwatcher_flow_log_retention_policy_days

The number of days for which the flow logs are retained. Flow logs are deleted by Azure at the end of a retention period.&#92;n

flowLogRetentionPolicyDays

Azure > Network Watcher > Flow Log > Retention Policy > Days

turbot_policy_setting.azure_network_network_security_group_ingress_rules_approved

turbot_policy_setting.azure_network_network_security_group_ingress_rules_approved_rules

turbot_policy_setting.azure_networkwatcher_flow_log_retention_policy

turbot_policy_setting.azure_networkwatcher_flow_log_retention_policy_days

turbot_policy_setting.azure_network_watcher_approved

turbot_policy_setting.azure_network_watcher_approved_custom

Policy	Setting	Note
Azure > Network > Network Security Group > Ingress Rules > Approved	Check: Approved	Azure CIS v2.0.0 - Controls: 6.1, 6.2, 6.3, 6.4
Azure > Network > Network Security Group > Ingress Rules > Approved > Rules	REJECT $.turbot.cidr:0.0.0.0/0 $.turbot.ports=22,3389,443,80 REJECT $.turbot.cidr:0.0.0.0/0 $.turbot.protocol:udp APPROVE *	Azure CIS v2.0.0 - Controls: 6.1, 6.2, 6.3, 6.4
Azure > Network Watcher > Flow Log > Retention Policy	Check: Enabled per `Retention Policy > Days`	Azure CIS v2.0.0 - Controls: 6.5
Azure > Network Watcher > Flow Log > Retention Policy > Days	90	Azure CIS v2.0.0 - Controls: 6.5
Azure > Network Watcher > Network Watcher > Approved	Check: Approved	Azure CIS v2.0.0 - Controls: 6.6
Azure > Network Watcher > Network Watcher > Approved > Custom	Calculated	Azure CIS v2.0.0 - Controls: 6.6

Policy Settings