Policy Packs

guardrails-samples

Ensure that only trusted, validated images are used, reducing the risk of security vulnerabilities and ensuring compliance with organizational policies and security standards.

Enforce Azure Compute Virtual Machines Use Approved AMIs From Trusted Publishers

main

azure_compute_virtual_machine_approved

Determine the action to take when an Azure Compute virtual machine is not approved based on `Azure &gt; Compute &gt; Virtual Machine &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

virtualMachineApproved

Azure > Compute > Virtual Machine > Approved

azure_compute_virtual_machine_approved_image

Determine whether the Virtual Machine is approved based on the AMI status&#92;n

virtualMachineApprovedImage

Azure > Compute > Virtual Machine > Approved > Image

azure_compute_virtual_machine_approved_image_local

Determine whether all local Images are enabled.  If enabled, all&#92;nlocal AMIs are enabled.&#92;n

virtualMachineApprovedImageLocal

Azure > Compute > Virtual Machine > Approved > Image > Local

azure_compute_virtual_machine_approved_image_rhel6

Determine the status of the standard RHEL 6 marketplace image:&#92;n  Enabled     - This is image is approved for use&#92;n  Deprecated  - This image cannot be used to launch new vms, but&#92;n                existing vms launched from it may continue to run&#92;n  Disabled    - This image is unapproved&#92;n

virtualMachineApprovedImageRHEL6

Azure > Compute > Virtual Machine > Approved > Image > RHEL 6

azure_compute_virtual_machine_approved_image_rhel7

Determine the status of the standard RHEL 7 marketplace image:&#92;n  Enabled     - This is image is approved for use&#92;n  Deprecated  - This image cannot be used to launch new vms, but&#92;n                existing vms launched from it may continue to run&#92;n  Disabled    - This image is unapproved&#92;n

virtualMachineApprovedImageRHEL7

Azure > Compute > Virtual Machine > Approved > Image > RHEL 7

azure_compute_virtual_machine_approved_image_rules

An OCL policy to define the status of Images based on fields in the image reference data.&#92;n&#92;nStandard OCL syntax may be used.  Allowed actions are:&#92;n  ENABLED     - Images that match should be considered &quot;enabled&quot;&#92;n  DEPRECATED  - Images that match should be considered &quot;deprecated&quot;&#92;n  DISABLED    - Images that match should be considered &quot;disabled&quot; and may not be used&#92;n&#92;nExamples:&#92;n  ENABLED *    # Allow all images published&#92;n  DEPRECATED $.publisher:MicrosoftWindowsServer $.sku:2016-Datacenter $.offer:WindowsServer # Windows Server 2016 images are deprecated.  New vms may not use these Images&#92;n  DISABLED $.publisher:MicrosoftWindowsServer $.sku:/^2012-/ $.offer:WindowsServer # Windows Server 2012 images are disabled.&#92;n

virtualMachineApprovedImageRules

Azure > Compute > Virtual Machine > Approved > Image > Rules

azure_compute_virtual_machine_approved_image_ubuntu16

Determine the status of the standard Ubuntu 16.04 marketplace image:&#92;n  Enabled     - This is image is approved for use&#92;n  Deprecated  - This image cannot be used to launch new vms, but&#92;n                existing vms launched from it may continue to run&#92;n  Disabled    - This image is unapproved&#92;n

virtualMachineApprovedImageUbuntu16

Azure > Compute > Virtual Machine > Approved > Image > Ubuntu 16.04

azure_compute_virtual_machine_approved_image_ubuntu18

Determine the status of the standard Ubuntu 18.04 marketplace image:&#92;n  Enabled     - This is image is approved for use&#92;n  Deprecated  - This image cannot be used to launch new vms, but&#92;n                existing vms launched from it may continue to run&#92;n  Disabled    - This image is unapproved&#92;n

virtualMachineApprovedImageUbuntu18

Azure > Compute > Virtual Machine > Approved > Image > Ubuntu 18.04

azure_compute_virtual_machine_approved_image_windows2012_data_center

Determine the status of the standard Windows 2012-R2 Datacenter marketplace image:&#92;n  Enabled     - This is image is approved for use&#92;n  Deprecated  - This image cannot be used to launch new vms, but&#92;n                existing vms launched from it may continue to run&#92;n  Disabled    - This image is unapproved&#92;n

virtualMachineApprovedImageWindows2012DataCenter

Azure > Compute > Virtual Machine > Approved > Image > Windows 2012-R2 Datacenter

azure_compute_virtual_machine_approved_image_windows2016_data_center

Determine the status of the standard Windows 2016 Datacenter marketplace image:&#92;n  Enabled     - This is image is approved for use&#92;n  Deprecated  - This image cannot be used to launch new vms, but&#92;n                existing vms launched from it may continue to run&#92;n  Disabled    - This image is unapproved&#92;n

virtualMachineApprovedImageWindows2016DataCenter

Azure > Compute > Virtual Machine > Approved > Image > Windows 2016 Datacenter

azure_compute_virtual_machine_approved_image_windows2019_data_center

Determine the status of the standard Windows 2019 Datacenter marketplace image:&#92;n  Enabled     - This is image is approved for use&#92;n  Deprecated  - This image cannot be used to launch new vms, but&#92;n                existing vms launched from it may continue to run&#92;n  Disabled    - This image is unapproved&#92;n

virtualMachineApprovedImageWindows2019DataCenter

Azure > Compute > Virtual Machine > Approved > Image > Windows 2019 Datacenter

turbot_policy_setting.azure_compute_virtual_machine_approved

turbot_policy_setting.azure_compute_virtual_machine_approved_image

turbot_policy_setting.azure_compute_virtual_machine_approved_image_local

turbot_policy_setting.azure_compute_virtual_machine_approved_image_rhel6

turbot_policy_setting.azure_compute_virtual_machine_approved_image_rhel7

turbot_policy_setting.azure_compute_virtual_machine_approved_image_rules

turbot_policy_setting.azure_compute_virtual_machine_approved_image_ubuntu16

turbot_policy_setting.azure_compute_virtual_machine_approved_image_ubuntu18

turbot_policy_setting.azure_compute_virtual_machine_approved_image_windows2012_data_center

turbot_policy_setting.azure_compute_virtual_machine_approved_image_windows2016_data_center

turbot_policy_setting.azure_compute_virtual_machine_approved_image_windows2019_data_center

Policy	Setting	Note
Azure > Compute > Virtual Machine > Approved	Check: Approved
Azure > Compute > Virtual Machine > Approved > Image	Approved if Image > Status is Enabled
Azure > Compute > Virtual Machine > Approved > Image > Local	Enabled
Azure > Compute > Virtual Machine > Approved > Image > RHEL 6	Disabled
Azure > Compute > Virtual Machine > Approved > Image > RHEL 7	Disabled
Azure > Compute > Virtual Machine > Approved > Image > Rules	Calculated
Azure > Compute > Virtual Machine > Approved > Image > Ubuntu 16.04	Disabled
Azure > Compute > Virtual Machine > Approved > Image > Ubuntu 18.04	Disabled
Azure > Compute > Virtual Machine > Approved > Image > Windows 2012-R2 Datacenter	Disabled
Azure > Compute > Virtual Machine > Approved > Image > Windows 2016 Datacenter	Disabled
Azure > Compute > Virtual Machine > Approved > Image > Windows 2019 Datacenter	Disabled

Policy Settings