Skip to content

Commit b22f284

Browse files
Prajwal-MicrosoftPrajwal-Microsoft
authored
Merge pull request #435 from microsoft/feature/sfi-security-fixes
fix: address SFI security compliance issues
2 parents 19b85e8 + febe9b9 commit b22f284

4 files changed

Lines changed: 98 additions & 34 deletions

File tree

‎infra/main.bicep‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -518,6 +518,7 @@ var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}'
518518
var dataCollectionRulesLocation = useExistingLogAnalytics
519519
? existingLogAnalyticsWorkspace!.location
520520
: logAnalyticsWorkspace!.outputs.location
521+
var dcrLogAnalyticsDestinationName = 'la-${logAnalyticsWorkspaceName}-destination'
521522
module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-rule:0.11.0' = if (enablePrivateNetworking && enableMonitoring) {
522523
name: take('avm.res.insights.data-collection-rule.${dataCollectionRulesResourceName}', 64)
523524
params: {
@@ -586,12 +587,23 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
586587
name: 'perfCounterDataSource60'
587588
}
588589
]
590+
windowsEventLogs: [
591+
{
592+
name: 'SecurityAuditEvents'
593+
streams: [
594+
'Microsoft-Event'
595+
]
596+
xPathQueries: [
597+
'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]'
598+
]
599+
}
600+
]
589601
}
590602
destinations: {
591603
logAnalytics: [
592604
{
593605
workspaceResourceId: logAnalyticsWorkspaceResourceId
594-
name: 'la-${dataCollectionRulesResourceName}'
606+
name: dcrLogAnalyticsDestinationName
595607
}
596608
]
597609
}
@@ -601,8 +613,18 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
601613
'Microsoft-Perf'
602614
]
603615
destinations: [
604-
'la-${dataCollectionRulesResourceName}'
616+
dcrLogAnalyticsDestinationName
617+
]
618+
}
619+
{
620+
streams: [
621+
'Microsoft-Event'
622+
]
623+
destinations: [
624+
dcrLogAnalyticsDestinationName
605625
]
626+
transformKql: 'source'
627+
outputStream: 'Microsoft-Event'
606628
}
607629
]
608630
}
@@ -1077,6 +1099,7 @@ module containerAppBackend 'br/public:avm/res/app/container-app:0.22.0' = {
10771099
]
10781100
ingressTargetPort: 8000
10791101
ingressExternal: true
1102+
ingressAllowInsecure: false
10801103
scaleSettings: {
10811104
// maxReplicas: enableScalability ? 3 : 1
10821105
maxReplicas: 1 // maxReplicas set to 1 (not 3) due to multiple agents created per type during WAF deployment
@@ -1132,6 +1155,7 @@ module containerAppFrontend 'br/public:avm/res/app/container-app:0.22.0' = {
11321155
]
11331156
ingressTargetPort: 3000
11341157
ingressExternal: true
1158+
ingressAllowInsecure: false
11351159
scaleSettings: {
11361160
maxReplicas: enableScalability ? 3 : 1
11371161
minReplicas: 1

‎infra/main.json‎

Lines changed: 54 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@
55
"metadata": {
66
"_generator": {
77
"name": "bicep",
8-
"version": "0.43.8.12551",
9-
"templateHash": "2263929965524886405"
8+
"version": "0.42.1.51946",
9+
"templateHash": "18156607440911418905"
1010
},
1111
"name": "Modernize Your Code Solution Accelerator",
12-
"description": "CSA CTO Gold Standard Solution Accelerator for Modernize Your Code. \n"
12+
"description": "CSA CTO Gold Standard Solution Accelerator for Modernize Your Code. \r\n"
1313
},
1414
"parameters": {
1515
"solutionName": {
@@ -5093,8 +5093,8 @@
50935093
"metadata": {
50945094
"_generator": {
50955095
"name": "bicep",
5096-
"version": "0.43.8.12551",
5097-
"templateHash": "14487392921976794826"
5096+
"version": "0.42.1.51946",
5097+
"templateHash": "15922750226218572834"
50985098
}
50995099
},
51005100
"definitions": {
@@ -13101,11 +13101,11 @@
1310113101
},
1310213102
"dependsOn": [
1310313103
"applicationInsights",
13104-
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').ods)]",
13105-
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').monitor)]",
13106-
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageBlob)]",
1310713104
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').oms)]",
13105+
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageBlob)]",
13106+
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').ods)]",
1310813107
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').agentSvc)]",
13108+
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').monitor)]",
1310913109
"dataCollectionEndpoint",
1311013110
"logAnalyticsWorkspace",
1311113111
"virtualNetwork"
@@ -15351,13 +15351,24 @@
1535115351
],
1535215352
"name": "perfCounterDataSource60"
1535315353
}
15354+
],
15355+
"windowsEventLogs": [
15356+
{
15357+
"name": "SecurityAuditEvents",
15358+
"streams": [
15359+
"Microsoft-Event"
15360+
],
15361+
"xPathQueries": [
15362+
"Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]"
15363+
]
15364+
}
1535415365
]
1535515366
},
1535615367
"destinations": {
1535715368
"logAnalytics": [
1535815369
{
1535915370
"workspaceResourceId": "[if(variables('useExistingLogAnalytics'), parameters('existingLogAnalyticsWorkspaceId'), reference('logAnalyticsWorkspace').outputs.resourceId.value)]",
15360-
"name": "[format('la-{0}', variables('dataCollectionRulesResourceName'))]"
15371+
"name": "[format('la-{0}-destination', if(variables('useExistingLogAnalytics'), variables('existingLawName'), reference('logAnalyticsWorkspace').outputs.name.value))]"
1536115372
}
1536215373
]
1536315374
},
@@ -15367,8 +15378,18 @@
1536715378
"Microsoft-Perf"
1536815379
],
1536915380
"destinations": [
15370-
"[format('la-{0}', variables('dataCollectionRulesResourceName'))]"
15381+
"[format('la-{0}-destination', if(variables('useExistingLogAnalytics'), variables('existingLawName'), reference('logAnalyticsWorkspace').outputs.name.value))]"
1537115382
]
15383+
},
15384+
{
15385+
"streams": [
15386+
"Microsoft-Event"
15387+
],
15388+
"destinations": [
15389+
"[format('la-{0}-destination', if(variables('useExistingLogAnalytics'), variables('existingLawName'), reference('logAnalyticsWorkspace').outputs.name.value))]"
15390+
],
15391+
"transformKql": "source",
15392+
"outputStream": "Microsoft-Event"
1537215393
}
1537315394
]
1537415395
}
@@ -26168,8 +26189,8 @@
2616826189
"metadata": {
2616926190
"_generator": {
2617026191
"name": "bicep",
26171-
"version": "0.43.8.12551",
26172-
"templateHash": "5833130864503278162"
26192+
"version": "0.42.1.51946",
26193+
"templateHash": "7788164101952925462"
2617326194
},
2617426195
"name": "AI Services and Project Module",
2617526196
"description": "This module creates an AI Services resource and an AI Foundry project within it. It supports private networking, OpenAI deployments, and role assignments."
@@ -27466,8 +27487,8 @@
2746627487
"metadata": {
2746727488
"_generator": {
2746827489
"name": "bicep",
27469-
"version": "0.43.8.12551",
27470-
"templateHash": "427786211377533956"
27490+
"version": "0.42.1.51946",
27491+
"templateHash": "3451497265231138743"
2747127492
}
2747227493
},
2747327494
"definitions": {
@@ -29176,8 +29197,8 @@
2917629197
"metadata": {
2917729198
"_generator": {
2917829199
"name": "bicep",
29179-
"version": "0.43.8.12551",
29180-
"templateHash": "9014582203949799641"
29200+
"version": "0.42.1.51946",
29201+
"templateHash": "6439859910553532577"
2918129202
}
2918229203
},
2918329204
"definitions": {
@@ -29391,8 +29412,8 @@
2939129412
"metadata": {
2939229413
"_generator": {
2939329414
"name": "bicep",
29394-
"version": "0.43.8.12551",
29395-
"templateHash": "427786211377533956"
29415+
"version": "0.42.1.51946",
29416+
"templateHash": "3451497265231138743"
2939629417
}
2939729418
},
2939829419
"definitions": {
@@ -31101,8 +31122,8 @@
3110131122
"metadata": {
3110231123
"_generator": {
3110331124
"name": "bicep",
31104-
"version": "0.43.8.12551",
31105-
"templateHash": "9014582203949799641"
31125+
"version": "0.42.1.51946",
31126+
"templateHash": "6439859910553532577"
3110631127
}
3110731128
},
3110831129
"definitions": {
@@ -32017,9 +32038,9 @@
3201732038
},
3201832039
"dependsOn": [
3201932040
"aiServices",
32020-
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]",
32021-
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]",
3202232041
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]",
32042+
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]",
32043+
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]",
3202332044
"virtualNetwork"
3202432045
]
3202532046
},
@@ -32075,8 +32096,8 @@
3207532096
"metadata": {
3207632097
"_generator": {
3207732098
"name": "bicep",
32078-
"version": "0.43.8.12551",
32079-
"templateHash": "12228537903958998388"
32099+
"version": "0.42.1.51946",
32100+
"templateHash": "15460841004653840446"
3208032101
}
3208132102
},
3208232103
"definitions": {
@@ -32314,7 +32335,7 @@
3231432335
"value": "TLS1_2"
3231532336
},
3231632337
"requireInfrastructureEncryption": {
32317-
"value": false
32338+
"value": true
3231832339
},
3231932340
"keyType": {
3232032341
"value": "Service"
@@ -40529,8 +40550,8 @@
4052940550
"metadata": {
4053040551
"_generator": {
4053140552
"name": "bicep",
40532-
"version": "0.43.8.12551",
40533-
"templateHash": "9897457440526781857"
40553+
"version": "0.42.1.51946",
40554+
"templateHash": "9745767047675020484"
4053440555
}
4053540556
},
4053640557
"definitions": {
@@ -47977,6 +47998,9 @@
4797747998
"ingressExternal": {
4797847999
"value": true
4797948000
},
48001+
"ingressAllowInsecure": {
48002+
"value": false
48003+
},
4798048004
"scaleSettings": {
4798148005
"value": {
4798248006
"maxReplicas": 1,
@@ -49551,6 +49575,9 @@
4955149575
"ingressExternal": {
4955249576
"value": true
4955349577
},
49578+
"ingressAllowInsecure": {
49579+
"value": false
49580+
},
4955449581
"scaleSettings": {
4955549582
"value": {
4955649583
"maxReplicas": "[if(parameters('enableScalability'), 3, 1)]",

‎infra/main_custom.bicep‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -426,6 +426,7 @@ var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}'
426426
var dataCollectionRulesLocation = useExistingLogAnalytics
427427
? existingLogAnalyticsWorkspace!.location
428428
: logAnalyticsWorkspace!.outputs.location
429+
var dcrLogAnalyticsDestinationName = 'la-${logAnalyticsWorkspaceName}-destination'
429430
module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-rule:0.11.0' = if (enablePrivateNetworking && enableMonitoring) {
430431
name: take('avm.res.insights.data-collection-rule.${dataCollectionRulesResourceName}', 64)
431432
params: {
@@ -497,10 +498,10 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
497498
{
498499
name: 'SecurityAuditEvents'
499500
streams: [
500-
'Microsoft-WindowsEvent'
501+
'Microsoft-Event'
501502
]
502503
xPathQueries: [
503-
'Security!*[System[(EventID=4624 or EventID=4625)]]'
504+
'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]'
504505
]
505506
}
506507
]
@@ -509,7 +510,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
509510
logAnalytics: [
510511
{
511512
workspaceResourceId: logAnalyticsWorkspaceResourceId
512-
name: 'la-${dataCollectionRulesResourceName}'
513+
name: dcrLogAnalyticsDestinationName
513514
}
514515
]
515516
}
@@ -519,11 +520,21 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
519520
'Microsoft-Perf'
520521
]
521522
destinations: [
522-
'la-${dataCollectionRulesResourceName}'
523+
dcrLogAnalyticsDestinationName
523524
]
524525
transformKql: 'source'
525526
outputStream: 'Microsoft-Perf'
526527
}
528+
{
529+
streams: [
530+
'Microsoft-Event'
531+
]
532+
destinations: [
533+
dcrLogAnalyticsDestinationName
534+
]
535+
transformKql: 'source'
536+
outputStream: 'Microsoft-Event'
537+
}
527538
]
528539
}
529540
}
@@ -1022,6 +1033,7 @@ module containerAppBackend 'br/public:avm/res/app/container-app:0.22.0' = {
10221033
]
10231034
ingressTargetPort: 8000
10241035
ingressExternal: true
1036+
ingressAllowInsecure: false
10251037
scaleSettings: {
10261038
// maxReplicas: enableScalability ? 3 : 1
10271039
maxReplicas: 1 // maxReplicas set to 1 (not 3) due to multiple agents created per type during WAF deployment
@@ -1085,6 +1097,7 @@ module containerAppFrontend 'br/public:avm/res/app/container-app:0.22.0' = {
10851097
]
10861098
ingressTargetPort: 3000
10871099
ingressExternal: true
1100+
ingressAllowInsecure: false
10881101
scaleSettings: {
10891102
maxReplicas: enableScalability ? 3 : 1
10901103
minReplicas: 1

‎infra/modules/storageAccount.bicep‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ module storageAccount 'br/public:avm/res/storage/storage-account:0.32.0' = {
5858
allowSharedKeyAccess: false
5959
allowCrossTenantReplication: false
6060
minimumTlsVersion: 'TLS1_2'
61-
requireInfrastructureEncryption: false
61+
requireInfrastructureEncryption: true
6262
keyType: 'Service'
6363
enableHierarchicalNamespace: false
6464
enableNfsV3: false

0 commit comments

Comments
 (0)