Governance Policies Azure Compute Batch

Batch

Governance policies for Batch

Domain: azure-compute

Patterns

Name	Description
Batch account with user-subscription pools and private networking	Batch account with AAD auth, private endpoints, VNet-injected pools, and auto-scale

Anti-Patterns

Description	Instead
Do not use shared key authentication for Batch	Set allowedAuthenticationModes to AAD only and use managed identity
Do not deploy pools with public IP addresses	Use VNet injection with publicIPAddressConfiguration set to NoPublicIPAddresses

References

• Azure Batch security best practices
• Batch account with private endpoints

---

Checks (4)

Check	Severity	Description
AZ-BATCH-001	Required	Deploy Azure Batch account with managed identity, no public access, and user-subscription pool allocation mode
AZ-BATCH-002	Required	Deploy Batch pools with VNet injection and no public IP for compute nodes
AZ-BATCH-003	Recommended	Configure auto-scale formulas for cost optimization
AZ-BATCH-004	Recommended	Use container task execution for reproducible and isolated job processing

---

AZ-BATCH-001

Deploy Azure Batch account with managed identity, no public access, and user-subscription pool allocation mode

Severity: Required
Rationale: User-subscription mode puts VMs in your subscription for VNet control; managed identity eliminates shared key usage
Agents: terraform-agent, bicep-agent, cloud-architect

Targets

• Microsoft.Batch/batchAccounts

Companion Resources

Resource	Name	Purpose
Microsoft.Network/privateEndpoints	pe-batch	Private endpoint for Batch account management plane
Microsoft.Network/privateDnsZones	privatelink.batch.azure.com	Private DNS zone for Batch account private endpoint resolution
Microsoft.Insights/diagnosticSettings	diag-batch	Diagnostic settings to route Batch service logs and task events to Log Analytics
Microsoft.Authorization/roleAssignments	Batch Account Contributor	RBAC role assignment for Batch account management and pool operations

---

AZ-BATCH-002

Deploy Batch pools with VNet injection and no public IP for compute nodes

Severity: Required
Rationale: Compute nodes with public IPs create attack surface; VNet injection enables network security group control
Agents: terraform-agent, bicep-agent, cloud-architect

Targets

• Microsoft.Batch/batchAccounts

---

AZ-BATCH-003

Configure auto-scale formulas for cost optimization

Severity: Recommended
Rationale: Static pools waste resources during idle periods; auto-scale adjusts capacity to workload demand
Agents: terraform-agent, bicep-agent, cloud-architect, cost-analyst

Targets

• Microsoft.Batch/batchAccounts

---

AZ-BATCH-004

Use container task execution for reproducible and isolated job processing

Severity: Recommended
Rationale: Container tasks provide consistent execution environments and faster node startup via pre-fetched images
Agents: terraform-agent, bicep-agent, cloud-architect, app-developer, csharp-developer, python-developer

Targets

• Microsoft.Batch/batchAccounts

---