Policy Packs

guardrails-samples

This section contains recommendations for configuring Azure virtual machines.

Azure CIS v2.0.0 - Section 7 - Virtual Machines

main

azure_compute_disk_encryption_at_rest

Define the Encryption at Rest settings required for `Azure &gt; Compute &gt; Disk`.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written to an underlying storage system. This control determines whether the resource is encrypted at rest, and sets encryption.&#92;n&#92;nThe [Encryption at Rest](https://turbot.com/guardrails/docs/concepts/guardrails/encryption-at-rest) control compares the encryption settings against the encryption policies for the resource (`Azure &gt; Compute &gt; Disk &gt; Encryption at Rest`), raises an alarm, and takes the defined enforcement action.&#92;n

diskEncryptionAtRest

Azure > Compute > Disk > Encryption at Rest

azure_compute_disk_encryption_at_rest_disk_encryption_set

Define the Disk Encryption Set ID for encryption at rest.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written to an underlying storage system. This control determines whether the resource is encrypted at rest, and sets encryption to your desired level.&#92;n&#92;nThe [Encryption at Rest](https://turbot.com/guardrails/docs/concepts/guardrails/encryption-at-rest) control compares the encryption settings against the encryption policies for the resource (`Azure &gt; Compute &gt; Disk &gt; Encryption at Rest  &gt; *`), raises an alarm, and takes the defined enforcement action&#92;n&#92;nPlease make sure the key defined in the template has required permissions.&#92;n&#92;n```&#92;nexample:&#92;n  /subscriptions/cd4401c4-3cc8-4565-a594-839c1e345f1e/resourceGroups/madhushree_test/providers/Microsoft.Compute/diskEncryptionSets/test-disk-encryption-set-cis&#92;n```&#92;n

diskEncryptionAtRestDiskEncryptionSet

Azure > Compute > Disk > Encryption at Rest > Disk Encryption Set

azure_compute_virtual_machine_approved

Determine the action to take when an Azure Compute virtual machine is not approved based on `Azure &gt; Compute &gt; Virtual Machine &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

virtualMachineApproved

Azure > Compute > Virtual Machine > Approved

azure_compute_virtual_machine_approved_custom

Determine whether the Azure Compute virtual machine is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If an Azure Compute virtual machine is not approved, it will be subject to the action specified in the `Azure &gt; Compute &gt; Virtual Machine &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

Policy	Setting	Note
Azure > Compute > Disk > Encryption at Rest	Check: Encryption at Rest > Disk Encryption Set	Azure CIS v2.0.0 - Control: 7.3, 7.4 and 7.7
Azure > Compute > Disk > Encryption at Rest > Disk Encryption Set	/subscriptions/cd1234c5-6cc7-8901-a234-567c8e901f2e/resourceGroups/myResourceGroup/providers/Microsoft.Compute/diskEncryptionSets/myDiskEncryptionSet	Azure CIS v2.0.0 - Control: 7.3, 7.4 and 7.7
Azure > Compute > Virtual Machine > Approved	Check: Approved	Azure CIS v2.0.0 - Control: 7.2, 7.5 and 7.6
Azure > Compute > Virtual Machine > Approved > Custom	Calculated	Azure CIS v2.0.0 - Control: 7.2, 7.5 and 7.6

Policy Settings