Skip to content

Commit a346194

Browse files
Prajwal-MicrosoftPrajwal-Microsoft
authored
Merge pull request #989 from microsoft/psl-fixexpsfiissues-macae
fix: address SFI security compliance issues
2 parents ca1b67d + 7b62e6c commit a346194

3 files changed

Lines changed: 67 additions & 48 deletions

File tree

‎infra/main.bicep‎

Lines changed: 21 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,7 @@
22
targetScope = 'resourceGroup'
33

44
metadata name = 'Multi-Agent Custom Automation Engine'
5-
metadata description = '''This module contains the resources required to deploy the [Multi-Agent Custom Automation Engine solution accelerator](https://github.com/microsoft/Multi-Agent-Custom-Automation-Engine-Solution-Accelerator) for both Sandbox environments and WAF aligned environments.
6-
7-
> **Note:** This module is not intended for broad, generic use, as it was designed by the Commercial Solution Areas CTO team, as a Microsoft Solution Accelerator. Feature requests and bug fix requests are welcome if they support the needs of this organization but may not be incorporated if they aim to make this module more generic than what it needs to be for its primary use case. This module will likely be updated to leverage AVM resource modules in the future. This may result in breaking changes in upcoming versions when these features are implemented.
8-
'''
5+
metadata description = 'This module contains the resources required to deploy the [Multi-Agent Custom Automation Engine solution accelerator](https://github.com/microsoft/Multi-Agent-Custom-Automation-Engine-Solution-Accelerator) for both Sandbox environments and WAF aligned environments.\n\n> **Note:** This module is not intended for broad, generic use, as it was designed by the Commercial Solution Areas CTO team, as a Microsoft Solution Accelerator. Feature requests and bug fix requests are welcome if they support the needs of this organization but may not be incorporated if they aim to make this module more generic than what it needs to be for its primary use case. This module will likely be updated to leverage AVM resource modules in the future. This may result in breaking changes in upcoming versions when these features are implemented.\n'
96

107
@description('Optional. A unique application/solution name for all resources in this deployment. This should be 3-16 characters long.')
118
@minLength(3)
@@ -479,6 +476,7 @@ var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}'
479476
var dataCollectionRulesLocation = useExistingLogAnalytics
480477
? existingLogAnalyticsWorkspace!.location
481478
: logAnalyticsWorkspace!.outputs.location
479+
var dcrLogAnalyticsDestinationName = 'la-${logAnalyticsWorkspaceResourceName}-destination'
482480
module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-rule:0.11.0' = if (enablePrivateNetworking && enableMonitoring) {
483481
name: take('avm.res.insights.data-collection-rule.${dataCollectionRulesResourceName}', 64)
484482
params: {
@@ -550,19 +548,10 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
550548
{
551549
name: 'SecurityAuditEvents'
552550
streams: [
553-
'Microsoft-WindowsEvent'
554-
]
555-
eventLogName: 'Security'
556-
eventTypes: [
557-
{
558-
eventType: 'Audit Success'
559-
}
560-
{
561-
eventType: 'Audit Failure'
562-
}
551+
'Microsoft-Event'
563552
]
564553
xPathQueries: [
565-
'Security!*[System[(EventID=4624 or EventID=4625)]]'
554+
'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]'
566555
]
567556
}
568557
]
@@ -571,7 +560,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
571560
logAnalytics: [
572561
{
573562
workspaceResourceId: logAnalyticsWorkspaceResourceId
574-
name: 'la--1264800308'
563+
name: dcrLogAnalyticsDestinationName
575564
}
576565
]
577566
}
@@ -581,11 +570,21 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
581570
'Microsoft-Perf'
582571
]
583572
destinations: [
584-
'la--1264800308'
573+
dcrLogAnalyticsDestinationName
585574
]
586575
transformKql: 'source'
587576
outputStream: 'Microsoft-Perf'
588577
}
578+
{
579+
streams: [
580+
'Microsoft-Event'
581+
]
582+
destinations: [
583+
dcrLogAnalyticsDestinationName
584+
]
585+
transformKql: 'source'
586+
outputStream: 'Microsoft-Event'
587+
}
589588
]
590589
}
591590
}
@@ -1213,6 +1212,8 @@ module containerApp 'br/public:avm/res/app/container-app:0.22.0' = {
12131212
ingressTargetPort: 8000
12141213
ingressExternal: true
12151214
activeRevisionsMode: 'Single'
1215+
// SFI: Enforce HTTPS-only ingress. When false, HTTP requests are automatically redirected to HTTPS.
1216+
ingressAllowInsecure: false
12161217
corsPolicy: {
12171218
allowedOrigins: [
12181219
'https://${webSiteResourceName}.azurewebsites.net'
@@ -1421,6 +1422,8 @@ module containerAppMcp 'br/public:avm/res/app/container-app:0.22.0' = {
14211422
ingressTargetPort: 9000
14221423
ingressExternal: true
14231424
activeRevisionsMode: 'Single'
1425+
// SFI: Enforce HTTPS-only ingress. When false, HTTP requests are automatically redirected to HTTPS.
1426+
ingressAllowInsecure: false
14241427
corsPolicy: {
14251428
allowedOrigins: [
14261429
'https://${webSiteResourceName}.azurewebsites.net'
@@ -1596,6 +1599,7 @@ module avmStorageAccount 'br/public:avm/res/storage/storage-account:0.32.0' = {
15961599
tags: tags
15971600
accessTier: 'Hot'
15981601
supportsHttpsTrafficOnly: true
1602+
requireInfrastructureEncryption: true
15991603

16001604
roleAssignments: [
16011605
{

‎infra/main.json‎

Lines changed: 25 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"_generator": {
77
"name": "bicep",
88
"version": "0.43.8.12551",
9-
"templateHash": "12475542446442392463"
9+
"templateHash": "6587818059632090787"
1010
},
1111
"name": "Multi-Agent Custom Automation Engine",
1212
"description": "This module contains the resources required to deploy the [Multi-Agent Custom Automation Engine solution accelerator](https://github.com/microsoft/Multi-Agent-Custom-Automation-Engine-Solution-Accelerator) for both Sandbox environments and WAF aligned environments.\n\n> **Note:** This module is not intended for broad, generic use, as it was designed by the Commercial Solution Areas CTO team, as a Microsoft Solution Accelerator. Feature requests and bug fix requests are welcome if they support the needs of this organization but may not be incorporated if they aim to make this module more generic than what it needs to be for its primary use case. This module will likely be updated to leverage AVM resource modules in the future. This may result in breaking changes in upcoming versions when these features are implemented.\n"
@@ -415,6 +415,7 @@
415415
"bastionResourceName": "[format('bas-{0}', variables('solutionSuffix'))]",
416416
"maintenanceConfigurationResourceName": "[format('mc-{0}', variables('solutionSuffix'))]",
417417
"dataCollectionRulesResourceName": "[format('dcr-{0}', variables('solutionSuffix'))]",
418+
"dcrLogAnalyticsDestinationName": "[format('la-{0}-destination', variables('logAnalyticsWorkspaceResourceName'))]",
418419
"proximityPlacementGroupResourceName": "[format('ppg-{0}', variables('solutionSuffix'))]",
419420
"virtualMachineResourceName": "[format('vm-{0}', variables('solutionSuffix'))]",
420421
"virtualMachineAvailabilityZone": 1,
@@ -10065,19 +10066,10 @@
1006510066
{
1006610067
"name": "SecurityAuditEvents",
1006710068
"streams": [
10068-
"Microsoft-WindowsEvent"
10069-
],
10070-
"eventLogName": "Security",
10071-
"eventTypes": [
10072-
{
10073-
"eventType": "Audit Success"
10074-
},
10075-
{
10076-
"eventType": "Audit Failure"
10077-
}
10069+
"Microsoft-Event"
1007810070
],
1007910071
"xPathQueries": [
10080-
"Security!*[System[(EventID=4624 or EventID=4625)]]"
10072+
"Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]"
1008110073
]
1008210074
}
1008310075
]
@@ -10086,7 +10078,7 @@
1008610078
"logAnalytics": [
1008710079
{
1008810080
"workspaceResourceId": "[if(variables('useExistingLogAnalytics'), parameters('existingLogAnalyticsWorkspaceId'), reference('logAnalyticsWorkspace').outputs.resourceId.value)]",
10089-
"name": "la--1264800308"
10081+
"name": "[variables('dcrLogAnalyticsDestinationName')]"
1009010082
}
1009110083
]
1009210084
},
@@ -10096,10 +10088,20 @@
1009610088
"Microsoft-Perf"
1009710089
],
1009810090
"destinations": [
10099-
"la--1264800308"
10091+
"[variables('dcrLogAnalyticsDestinationName')]"
1010010092
],
1010110093
"transformKql": "source",
1010210094
"outputStream": "Microsoft-Perf"
10095+
},
10096+
{
10097+
"streams": [
10098+
"Microsoft-Event"
10099+
],
10100+
"destinations": [
10101+
"[variables('dcrLogAnalyticsDestinationName')]"
10102+
],
10103+
"transformKql": "source",
10104+
"outputStream": "Microsoft-Event"
1010310105
}
1010410106
]
1010510107
}
@@ -38445,6 +38447,9 @@
3844538447
"activeRevisionsMode": {
3844638448
"value": "Single"
3844738449
},
38450+
"ingressAllowInsecure": {
38451+
"value": false
38452+
},
3844838453
"corsPolicy": {
3844938454
"value": {
3845038455
"allowedOrigins": [
@@ -40187,6 +40192,9 @@
4018740192
"activeRevisionsMode": {
4018840193
"value": "Single"
4018940194
},
40195+
"ingressAllowInsecure": {
40196+
"value": false
40197+
},
4019040198
"corsPolicy": {
4019140199
"value": {
4019240200
"allowedOrigins": [
@@ -44510,6 +44518,9 @@
4451044518
"supportsHttpsTrafficOnly": {
4451144519
"value": true
4451244520
},
44521+
"requireInfrastructureEncryption": {
44522+
"value": true
44523+
},
4451344524
"roleAssignments": {
4451444525
"value": [
4451544526
{

‎infra/main_custom.bicep‎

Lines changed: 21 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,7 @@
22
targetScope = 'resourceGroup'
33

44
metadata name = 'Multi-Agent Custom Automation Engine'
5-
metadata description = '''This module contains the resources required to deploy the [Multi-Agent Custom Automation Engine solution accelerator](https://github.com/microsoft/Multi-Agent-Custom-Automation-Engine-Solution-Accelerator) for both Sandbox environments and WAF aligned environments.
6-
7-
> **Note:** This module is not intended for broad, generic use, as it was designed by the Commercial Solution Areas CTO team, as a Microsoft Solution Accelerator. Feature requests and bug fix requests are welcome if they support the needs of this organization but may not be incorporated if they aim to make this module more generic than what it needs to be for its primary use case. This module will likely be updated to leverage AVM resource modules in the future. This may result in breaking changes in upcoming versions when these features are implemented.
8-
'''
5+
metadata description = 'This module contains the resources required to deploy the [Multi-Agent Custom Automation Engine solution accelerator](https://github.com/microsoft/Multi-Agent-Custom-Automation-Engine-Solution-Accelerator) for both Sandbox environments and WAF aligned environments.\n\n> **Note:** This module is not intended for broad, generic use, as it was designed by the Commercial Solution Areas CTO team, as a Microsoft Solution Accelerator. Feature requests and bug fix requests are welcome if they support the needs of this organization but may not be incorporated if they aim to make this module more generic than what it needs to be for its primary use case. This module will likely be updated to leverage AVM resource modules in the future. This may result in breaking changes in upcoming versions when these features are implemented.\n'
96

107
@description('Optional. A unique application/solution name for all resources in this deployment. This should be 3-16 characters long.')
118
@minLength(3)
@@ -478,6 +475,7 @@ var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}'
478475
var dataCollectionRulesLocation = useExistingLogAnalytics
479476
? existingLogAnalyticsWorkspace!.location
480477
: logAnalyticsWorkspace!.outputs.location
478+
var dcrLogAnalyticsDestinationName = 'la-${logAnalyticsWorkspaceResourceName}-destination'
481479
module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-rule:0.11.0' = if (enablePrivateNetworking && enableMonitoring) {
482480
name: take('avm.res.insights.data-collection-rule.${dataCollectionRulesResourceName}', 64)
483481
params: {
@@ -549,19 +547,10 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
549547
{
550548
name: 'SecurityAuditEvents'
551549
streams: [
552-
'Microsoft-WindowsEvent'
553-
]
554-
eventLogName: 'Security'
555-
eventTypes: [
556-
{
557-
eventType: 'Audit Success'
558-
}
559-
{
560-
eventType: 'Audit Failure'
561-
}
550+
'Microsoft-Event'
562551
]
563552
xPathQueries: [
564-
'Security!*[System[(EventID=4624 or EventID=4625)]]'
553+
'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]'
565554
]
566555
}
567556
]
@@ -570,7 +559,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
570559
logAnalytics: [
571560
{
572561
workspaceResourceId: logAnalyticsWorkspaceResourceId
573-
name: 'la--1264800308'
562+
name: dcrLogAnalyticsDestinationName
574563
}
575564
]
576565
}
@@ -580,11 +569,21 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
580569
'Microsoft-Perf'
581570
]
582571
destinations: [
583-
'la--1264800308'
572+
dcrLogAnalyticsDestinationName
584573
]
585574
transformKql: 'source'
586575
outputStream: 'Microsoft-Perf'
587576
}
577+
{
578+
streams: [
579+
'Microsoft-Event'
580+
]
581+
destinations: [
582+
dcrLogAnalyticsDestinationName
583+
]
584+
transformKql: 'source'
585+
outputStream: 'Microsoft-Event'
586+
}
588587
]
589588
}
590589
}
@@ -1240,6 +1239,8 @@ module containerApp 'br/public:avm/res/app/container-app:0.22.0' = {
12401239
ingressTargetPort: 8000
12411240
ingressExternal: true
12421241
activeRevisionsMode: 'Single'
1242+
// SFI: Enforce HTTPS-only ingress. When false, HTTP requests are automatically redirected to HTTPS.
1243+
ingressAllowInsecure: false
12431244
corsPolicy: {
12441245
allowedOrigins: [
12451246
'https://${webSiteResourceName}.azurewebsites.net'
@@ -1463,6 +1464,8 @@ module containerAppMcp 'br/public:avm/res/app/container-app:0.22.0' = {
14631464
ingressTargetPort: 9000
14641465
ingressExternal: true
14651466
activeRevisionsMode: 'Single'
1467+
// SFI: Enforce HTTPS-only ingress. When false, HTTP requests are automatically redirected to HTTPS.
1468+
ingressAllowInsecure: false
14661469
corsPolicy: {
14671470
allowedOrigins: [
14681471
'https://${webSiteResourceName}.azurewebsites.net'
@@ -1648,6 +1651,7 @@ module avmStorageAccount 'br/public:avm/res/storage/storage-account:0.32.0' = {
16481651
tags: tags
16491652
accessTier: 'Hot'
16501653
supportsHttpsTrafficOnly: true
1654+
requireInfrastructureEncryption: true
16511655

16521656
roleAssignments: [
16531657
{

0 commit comments

Comments
 (0)