Skip to content

Commit 81f8181

Browse files
Prajwal-MicrosoftPrajwal-Microsoft
authored
Merge pull request #593 from microsoft/sfi-fix
fix: update event stream names and enforce security settings in Bicep
2 parents 91c4622 + 3f17071 commit 81f8181

3 files changed

Lines changed: 75 additions & 46 deletions

File tree

‎infra/main.bicep‎

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -362,6 +362,8 @@ module maintenanceConfiguration 'br/public:avm/res/maintenance/maintenance-confi
362362

363363
var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}'
364364
var dataCollectionRulesLocation = logAnalyticsWorkspace!.outputs.location
365+
var logAnalyticsWorkspaceResourceName = 'log-${solutionSuffix}'
366+
var dcrLogAnalyticsDestinationName = 'la-${logAnalyticsWorkspaceResourceName}-destination'
365367
module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-rule:0.11.0' = if (enablePrivateNetworking && enableMonitoring) {
366368
name: take('avm.res.insights.data-collection-rule.${dataCollectionRulesResourceName}', 64)
367369
params: {
@@ -433,19 +435,10 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
433435
{
434436
name: 'SecurityAuditEvents'
435437
streams: [
436-
'Microsoft-WindowsEvent'
437-
]
438-
eventLogName: 'Security'
439-
eventTypes: [
440-
{
441-
eventType: 'Audit Success'
442-
}
443-
{
444-
eventType: 'Audit Failure'
445-
}
438+
'Microsoft-Event'
446439
]
447440
xPathQueries: [
448-
'Security!*[System[(EventID=4624 or EventID=4625)]]'
441+
'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]'
449442
]
450443
}
451444
]
@@ -454,7 +447,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
454447
logAnalytics: [
455448
{
456449
workspaceResourceId: logAnalyticsWorkspace!.outputs.resourceId
457-
name: 'la-${dataCollectionRulesResourceName}'
450+
name: dcrLogAnalyticsDestinationName
458451
}
459452
]
460453
}
@@ -464,11 +457,21 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
464457
'Microsoft-Perf'
465458
]
466459
destinations: [
467-
'la-${dataCollectionRulesResourceName}'
460+
dcrLogAnalyticsDestinationName
468461
]
469462
transformKql: 'source'
470463
outputStream: 'Microsoft-Perf'
471464
}
465+
{
466+
streams: [
467+
'Microsoft-Event'
468+
]
469+
destinations: [
470+
dcrLogAnalyticsDestinationName
471+
]
472+
transformKql: 'source'
473+
outputStream: 'Microsoft-Event'
474+
}
472475
]
473476
}
474477
}
@@ -517,7 +520,7 @@ module avmPrivateDnsZones 'br/public:avm/res/network/private-dns-zone:0.8.1' = [
517520
module logAnalyticsWorkspace 'modules/log-analytics-workspace.bicep' = if (enableMonitoring) {
518521
name: take('module.log-analytics-workspace.${solutionSuffix}', 64)
519522
params: {
520-
name: 'log-${solutionSuffix}'
523+
name: logAnalyticsWorkspaceResourceName
521524
location: location
522525
tags: tags
523526
enableTelemetry: enableTelemetry
@@ -654,6 +657,7 @@ module avmStorageAccount 'br/public:avm/res/storage/storage-account:0.32.0' = {
654657
defaultAction: (enablePrivateNetworking) ? 'Deny' : 'Allow'
655658
ipRules: []
656659
}
660+
requireInfrastructureEncryption: true
657661
supportsHttpsTrafficOnly: true
658662
accessTier: 'Hot'
659663
tags: tags
@@ -1048,6 +1052,7 @@ module avmContainerApp_API 'br/public:avm/res/app/container-app:0.22.1' = {
10481052
ingressExternal: true
10491053
activeRevisionsMode: 'Single'
10501054
ingressTransport: 'auto'
1055+
ingressAllowInsecure: false
10511056
corsPolicy: {
10521057
allowedOrigins: [
10531058
'*'
@@ -1089,6 +1094,7 @@ module avmContainerApp_Web 'br/public:avm/res/app/container-app:0.22.1' = {
10891094
ingressTargetPort: 3000
10901095
activeRevisionsMode: 'Single'
10911096
ingressTransport: 'auto'
1097+
ingressAllowInsecure: false
10921098
scaleSettings: {
10931099
maxReplicas: enableScalability ? 3 : 2
10941100
minReplicas: enableScalability ? 2 : 1
@@ -1722,6 +1728,7 @@ module avmContainerApp_API_update 'br/public:avm/res/app/container-app:0.22.1' =
17221728
ingressExternal: true
17231729
activeRevisionsMode: 'Single'
17241730
ingressTransport: 'auto'
1731+
ingressAllowInsecure: false
17251732
corsPolicy: {
17261733
allowedOrigins: [
17271734
'*'

‎infra/main.json‎

Lines changed: 33 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"_generator": {
77
"name": "bicep",
88
"version": "0.42.1.51946",
9-
"templateHash": "12078312041649297460"
9+
"templateHash": "5885652317352749587"
1010
},
1111
"name": "Content Processing Solution Accelerator",
1212
"description": "Bicep template to deploy the Content Processing Solution Accelerator with AVM compliance."
@@ -243,6 +243,8 @@
243243
"bastionHostName": "[format('bas-{0}', variables('solutionSuffix'))]",
244244
"jumpboxVmName": "[take(format('vm-{0}', variables('solutionSuffix')), 15)]",
245245
"dataCollectionRulesResourceName": "[format('dcr-{0}', variables('solutionSuffix'))]",
246+
"logAnalyticsWorkspaceResourceName": "[format('log-{0}', variables('solutionSuffix'))]",
247+
"dcrLogAnalyticsDestinationName": "[format('la-{0}-destination', variables('logAnalyticsWorkspaceResourceName'))]",
246248
"privateDnsZones": [
247249
"privatelink.cognitiveservices.azure.com",
248250
"privatelink.openai.azure.com",
@@ -14607,19 +14609,10 @@
1460714609
{
1460814610
"name": "SecurityAuditEvents",
1460914611
"streams": [
14610-
"Microsoft-WindowsEvent"
14611-
],
14612-
"eventLogName": "Security",
14613-
"eventTypes": [
14614-
{
14615-
"eventType": "Audit Success"
14616-
},
14617-
{
14618-
"eventType": "Audit Failure"
14619-
}
14612+
"Microsoft-Event"
1462014613
],
1462114614
"xPathQueries": [
14622-
"Security!*[System[(EventID=4624 or EventID=4625)]]"
14615+
"Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]"
1462314616
]
1462414617
}
1462514618
]
@@ -14628,7 +14621,7 @@
1462814621
"logAnalytics": [
1462914622
{
1463014623
"workspaceResourceId": "[reference('logAnalyticsWorkspace').outputs.resourceId.value]",
14631-
"name": "[format('la-{0}', variables('dataCollectionRulesResourceName'))]"
14624+
"name": "[variables('dcrLogAnalyticsDestinationName')]"
1463214625
}
1463314626
]
1463414627
},
@@ -14638,10 +14631,20 @@
1463814631
"Microsoft-Perf"
1463914632
],
1464014633
"destinations": [
14641-
"[format('la-{0}', variables('dataCollectionRulesResourceName'))]"
14634+
"[variables('dcrLogAnalyticsDestinationName')]"
1464214635
],
1464314636
"transformKql": "source",
1464414637
"outputStream": "Microsoft-Perf"
14638+
},
14639+
{
14640+
"streams": [
14641+
"Microsoft-Event"
14642+
],
14643+
"destinations": [
14644+
"[variables('dcrLogAnalyticsDestinationName')]"
14645+
],
14646+
"transformKql": "source",
14647+
"outputStream": "Microsoft-Event"
1464514648
}
1464614649
]
1464714650
}
@@ -19272,7 +19275,7 @@
1927219275
"mode": "Incremental",
1927319276
"parameters": {
1927419277
"name": {
19275-
"value": "[format('log-{0}', variables('solutionSuffix'))]"
19278+
"value": "[variables('logAnalyticsWorkspaceResourceName')]"
1927619279
},
1927719280
"location": {
1927819281
"value": "[parameters('location')]"
@@ -28050,6 +28053,9 @@
2805028053
"ipRules": []
2805128054
}
2805228055
},
28056+
"requireInfrastructureEncryption": {
28057+
"value": true
28058+
},
2805328059
"supportsHttpsTrafficOnly": {
2805428060
"value": true
2805528061
},
@@ -36177,8 +36183,8 @@
3617736183
"avmContainerApp_API",
3617836184
"avmContainerApp_Workflow",
3617936185
"avmManagedIdentity",
36180-
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageBlob)]",
3618136186
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageQueue)]",
36187+
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageBlob)]",
3618236188
"virtualNetwork"
3618336189
]
3618436190
},
@@ -42482,9 +42488,9 @@
4248242488
"dependsOn": [
4248342489
"avmAiServices",
4248442490
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').contentUnderstanding)]",
42485-
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]",
42486-
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]",
4248742491
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]",
42492+
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]",
42493+
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]",
4248842494
"virtualNetwork"
4248942495
]
4249042496
},
@@ -45910,6 +45916,9 @@
4591045916
"ingressTransport": {
4591145917
"value": "auto"
4591245918
},
45919+
"ingressAllowInsecure": {
45920+
"value": false
45921+
},
4591345922
"corsPolicy": {
4591445923
"value": {
4591545924
"allowedOrigins": [
@@ -47515,6 +47524,9 @@
4751547524
"ingressTransport": {
4751647525
"value": "auto"
4751747526
},
47527+
"ingressAllowInsecure": {
47528+
"value": false
47529+
},
4751847530
"scaleSettings": {
4751947531
"value": {
4752047532
"maxReplicas": "[if(parameters('enableScalability'), 3, 2)]",
@@ -63172,6 +63184,9 @@
6317263184
"ingressTransport": {
6317363185
"value": "auto"
6317463186
},
63187+
"ingressAllowInsecure": {
63188+
"value": false
63189+
},
6317563190
"corsPolicy": {
6317663191
"value": {
6317763192
"allowedOrigins": [

‎infra/main_custom.bicep‎

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -365,6 +365,8 @@ module maintenanceConfiguration 'br/public:avm/res/maintenance/maintenance-confi
365365

366366
var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}'
367367
var dataCollectionRulesLocation = logAnalyticsWorkspace!.outputs.location
368+
var logAnalyticsWorkspaceResourceName = 'log-${solutionSuffix}'
369+
var dcrLogAnalyticsDestinationName = 'la-${logAnalyticsWorkspaceResourceName}-destination'
368370
module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-rule:0.11.0' = if (enablePrivateNetworking && enableMonitoring) {
369371
name: take('avm.res.insights.data-collection-rule.${dataCollectionRulesResourceName}', 64)
370372
params: {
@@ -436,19 +438,10 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
436438
{
437439
name: 'SecurityAuditEvents'
438440
streams: [
439-
'Microsoft-WindowsEvent'
440-
]
441-
eventLogName: 'Security'
442-
eventTypes: [
443-
{
444-
eventType: 'Audit Success'
445-
}
446-
{
447-
eventType: 'Audit Failure'
448-
}
441+
'Microsoft-Event'
449442
]
450443
xPathQueries: [
451-
'Security!*[System[(EventID=4624 or EventID=4625)]]'
444+
'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]'
452445
]
453446
}
454447
]
@@ -457,7 +450,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
457450
logAnalytics: [
458451
{
459452
workspaceResourceId: logAnalyticsWorkspace!.outputs.resourceId
460-
name: 'la-${dataCollectionRulesResourceName}'
453+
name: dcrLogAnalyticsDestinationName
461454
}
462455
]
463456
}
@@ -467,11 +460,21 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
467460
'Microsoft-Perf'
468461
]
469462
destinations: [
470-
'la-${dataCollectionRulesResourceName}'
463+
dcrLogAnalyticsDestinationName
471464
]
472465
transformKql: 'source'
473466
outputStream: 'Microsoft-Perf'
474467
}
468+
{
469+
streams: [
470+
'Microsoft-Event'
471+
]
472+
destinations: [
473+
dcrLogAnalyticsDestinationName
474+
]
475+
transformKql: 'source'
476+
outputStream: 'Microsoft-Event'
477+
}
475478
]
476479
}
477480
}
@@ -520,7 +523,7 @@ module avmPrivateDnsZones 'br/public:avm/res/network/private-dns-zone:0.8.1' = [
520523
module logAnalyticsWorkspace 'modules/log-analytics-workspace.bicep' = if (enableMonitoring) {
521524
name: take('module.log-analytics-workspace.${solutionSuffix}', 64)
522525
params: {
523-
name: 'log-${solutionSuffix}'
526+
name: logAnalyticsWorkspaceResourceName
524527
location: location
525528
tags: tags
526529
enableTelemetry: enableTelemetry
@@ -657,6 +660,7 @@ module avmStorageAccount 'br/public:avm/res/storage/storage-account:0.32.0' = {
657660
defaultAction: (enablePrivateNetworking) ? 'Deny' : 'Allow'
658661
ipRules: []
659662
}
663+
requireInfrastructureEncryption: true
660664
supportsHttpsTrafficOnly: true
661665
accessTier: 'Hot'
662666
tags: tags
@@ -1061,6 +1065,7 @@ module avmContainerApp_API 'br/public:avm/res/app/container-app:0.22.1' = {
10611065
ingressExternal: true
10621066
activeRevisionsMode: 'Single'
10631067
ingressTransport: 'auto'
1068+
ingressAllowInsecure: false
10641069
corsPolicy: {
10651070
allowedOrigins: [
10661071
'*'
@@ -1107,6 +1112,7 @@ module avmContainerApp_Web 'br/public:avm/res/app/container-app:0.22.1' = {
11071112
ingressTargetPort: 3000
11081113
activeRevisionsMode: 'Single'
11091114
ingressTransport: 'auto'
1115+
ingressAllowInsecure: false
11101116
scaleSettings: {
11111117
maxReplicas: enableScalability ? 3 : 2
11121118
minReplicas: enableScalability ? 2 : 1
@@ -1756,6 +1762,7 @@ module avmContainerApp_API_update 'br/public:avm/res/app/container-app:0.22.1' =
17561762
ingressExternal: true
17571763
activeRevisionsMode: 'Single'
17581764
ingressTransport: 'auto'
1765+
ingressAllowInsecure: false
17591766
corsPolicy: {
17601767
allowedOrigins: [
17611768
'*'

0 commit comments

Comments
 (0)