Skip to content

Commit 463bc40

Browse files
BernieWhiteBernieWhite
authored
WAF rule updates #3102 (#3225)
1 parent da656a8 commit 463bc40

File tree

13 files changed

+368
-44
lines changed

13 files changed

+368
-44
lines changed

‎docs/CHANGELOG-v1.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,11 @@ What's changed since v1.40.0:
4444
- Updated documentation and promoted `Azure.ACR.AnonymousAccess` to GA by @BernieWhite.
4545
[#3119](https://github.com/Azure/PSRule.Rules.Azure/issues/3119)
4646
- Bumped rule set to `2024_12`.
47+
- General improvements:
48+
- **Important change**: Deprecated rules with no clear WAF alignment by @BernieWhite.
49+
[#3102](https://github.com/Azure/PSRule.Rules.Azure/issues/3102)
50+
- The following rules are deprecated:
51+
- `Azure.APIM.ProductTerms`
4752
- Engineering:
4853
- Updated resource providers and policy aliases by @BernieWhite.
4954
[#3166](https://github.com/Azure/PSRule.Rules.Azure/pull/3166)

‎docs/deprecations.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ The following rules are deprecated and will be removed in v2:
4040

4141
Reference ID | Name | Deprecated from | Reason
4242
------------ | ---- | --------------- | ------
43+
AZR-000050 | Azure.APIM.ProductTerms | v1.41.0 | No clear linkage to WAF.
4344
AZR-000217 | Azure.Template.UseParameters | v1.36.0 | Linting already handled by Bicep linter. No clear linkage to WAF.
4445
AZR-000219 | Azure.Template.UseVariables | v1.36.0 | Linting already handled by Bicep linter. No clear linkage to WAF.
4546
AZR-000218 | Azure.Template.DefineParameters | v1.36.0 | No applicable to Bicep. No clear linkage to WAF.

‎docs/en/rules/Azure.AKS.CNISubnetSize.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
severity: Important
33
pillar: Reliability
4-
category: Scalability
4+
category: PE:05 Scaling and partitioning
55
resource: Azure Kubernetes Service
66
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AKS.CNISubnetSize/
77
---
@@ -43,7 +43,7 @@ configuration:
4343
4444
## LINKS
4545
46-
- [Plan for growth](https://learn.microsoft.com/azure/architecture/framework/scalability/design-scale#plan-for-growth)
46+
- [PE:05 Scaling and partitioning](https://learn.microsoft.com/azure/well-architected/performance-efficiency/scale-partition#configure-scaling)
4747
- [Configure Azure CNI networking in Azure Kubernetes Service (AKS)](https://learn.microsoft.com/azure/aks/configure-azure-cni)
4848
- [Use kubenet networking with your own IP address ranges in Azure Kubernetes Service (AKS)](https://learn.microsoft.com/azure/aks/configure-kubenet)
4949
- [Tutorial: Configure Azure CNI networking in Azure Kubernetes Service (AKS) using Ansible](https://learn.microsoft.com/azure/developer/ansible/aks-configure-cni-networking)

‎docs/en/rules/Azure.APIM.ProductTerms.md‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
---
2+
deprecated: true
23
severity: Important
34
pillar: Operational Excellence
45
category: Configuration
56
resource: API Management
67
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.APIM.ProductTerms/
78
---
89

9-
# Use API product legal terms
10+
# API Management products do not have legal terms set
1011

1112
## SYNOPSIS
1213

@@ -25,6 +26,12 @@ Acceptance of legal terms is bypassed when an administrator creates a subscripti
2526

2627
Consider configuring legal terms for all products to declare acceptable use of included APIs.
2728

29+
## NOTES
30+
31+
This rule is deprecated from v1.41.0.
32+
By default, PSRule will not evaluate this rule unless explicitly enabled.
33+
See https://aka.ms/ps-rule-azure/deprecations.
34+
2835
## LINKS
2936

3037
- [Create and publish a product](https://learn.microsoft.com/azure/api-management/api-management-howto-add-products)

‎docs/en/rules/Azure.APIM.SampleProducts.md‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,37 @@
11
---
22
severity: Awareness
3-
pillar: Operational Excellence
4-
category: Configuration
3+
pillar: Security
4+
category: SE:08 Hardening resources
55
resource: API Management
66
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.APIM.SampleProducts/
77
---
88

9-
# Remove default products
9+
# API Management Service has default products present
1010

1111
## SYNOPSIS
1212

13-
Remove starter and unlimited sample products.
13+
API Management Services with default products configured may expose more APIs than intended.
1414

1515
## DESCRIPTION
1616

1717
API Management includes two sample products _Starter_ and _Unlimited_.
18-
Accidentally adding APIs to these sample products may expose APIs more than intended.
18+
These products are created by default when an API Management Service using V1 plans is created.
19+
20+
In both cases, these products are created with a default set of developer permissions that may be too permissive.
21+
Accidentally adding APIs to these sample products may expose API metadata to unauthorized users.
22+
23+
Before publishing APIs, plan access control for API development and usage.
24+
Additional products or workspaces can be created to manage discovery of APIs and enforce usage policies.
1925

2026
## RECOMMENDATION
2127

22-
Consider removing starter and unlimited sample products from API Management.
28+
Consider removing starter and unlimited products from API Management to reduce the risk of unauthorized API discovery.
29+
30+
## NOTES
31+
32+
This rule applies when analyzing API Management Services (in-flight) and running within Azure.
2333

2434
## LINKS
2535

36+
- [SE:08 Hardening resources](https://learn.microsoft.com/azure/well-architected/security/harden-resources)
2637
- [Create and publish a product](https://learn.microsoft.com/azure/api-management/api-management-howto-add-products)

‎docs/en/rules/Azure.LogicApp.LimitHTTPTrigger.md‎

Lines changed: 84 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,105 @@
11
---
2+
reviewed: 2025-01-17
23
severity: Critical
34
pillar: Security
4-
category: Network security and containment
5+
category: SE:06 Network controls
56
resource: Logic App
67
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.LogicApp.LimitHTTPTrigger/
78
---
89

9-
# Limit Logic App HTTP request triggers
10+
# Logic App HTTP request trigger is not restricted
1011

1112
## SYNOPSIS
1213

13-
Limit HTTP request trigger access to trusted IP addresses.
14+
Logic Apps using HTTP triggers without restrictions can be accessed from any network location including the Internet.
1415

1516
## DESCRIPTION
1617

17-
When a Logic App uses a HTTP request trigger by default any source IP address can trigger the workflow.
18-
Logic Apps can be configured to limit the IP addresses that are accepted to trigger the workflow.
18+
Logic Apps are workflows that integrate services and systems across cloud services and on-premises systems.
19+
Logic Apps can be triggered by a variety of events including HTTP requests.
20+
21+
When HTTP request trigger is configured,
22+
by default the Logic App in a consumption plan may receive requests from any source IP address.
23+
This can expose the Logic App to unauthorized access or exfiltration attempts.
24+
25+
Logic Apps can be secured by restricting access to trusted IP addresses.
1926

2027
## RECOMMENDATION
2128

22-
Consider limiting Logic Apps with HTTP request triggers to trusted IP addresses.
29+
Consider restricting HTTP triggers to trusted IP addresses to harden against unauthorized access or exfiltration attempts.
30+
31+
## EXAMPLES
32+
33+
### Configure with Azure template
34+
35+
To deploy Logic Apps that pass this rule:
36+
37+
- Set the `allowedCallerIpAddresses` property to a list of IP address ranges.
38+
39+
For example:
40+
41+
```json
42+
{
43+
"type": "Microsoft.Logic/workflows",
44+
"apiVersion": "2019-05-01",
45+
"name": "[parameters('name')]",
46+
"location": "[parameters('location')]",
47+
"properties": {
48+
"definition": "<workflow-definition>",
49+
"parameters": {},
50+
"accessControl": {
51+
"contents": {
52+
"allowedCallerIpAddresses": [
53+
{
54+
"addressRange": "192.168.12.0/23"
55+
},
56+
{
57+
"addressRange": "2001:0db8::/64"
58+
}
59+
]
60+
}
61+
}
62+
}
63+
}
64+
```
65+
66+
### Configure with Bicep
67+
68+
To deploy Logic Apps that pass this rule:
69+
70+
- Set the `allowedCallerIpAddresses` property to a list of IP address ranges.
71+
72+
For example:
73+
74+
```bicep
75+
resource app 'Microsoft.Logic/workflows@2019-05-01' = {
76+
name: name
77+
location: location
78+
properties: {
79+
definition: '<workflow-definition>'
80+
parameters: {}
81+
accessControl: {
82+
contents: {
83+
allowedCallerIpAddresses: [
84+
{
85+
addressRange: '192.168.12.0/23'
86+
}
87+
{
88+
addressRange: '2001:0db8::/64'
89+
}
90+
]
91+
}
92+
}
93+
}
94+
}
95+
```
96+
97+
## NOTES
98+
99+
This rule currently only applies to Logic Apps using consumption plans.
23100

24101
## LINKS
25102

103+
- [SE:06 Network controls](https://learn.microsoft.com/azure/well-architected/security/networking)
26104
- [Secure access and data in Azure Logic Apps](https://learn.microsoft.com/azure/logic-apps/logic-apps-securing-a-logic-app)
27105
- [Azure security baseline for Logic Apps](https://learn.microsoft.com/azure/logic-apps/security-baseline#network-security)

‎docs/en/rules/Azure.VM.Agent.md‎

Lines changed: 138 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,161 @@
11
---
22
severity: Important
33
pillar: Operational Excellence
4-
category: Monitoring
4+
category: OE:10 Automation design
55
resource: Virtual Machine
66
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.VM.Agent/
77
ms-content-id: e4f6f6e7-593c-4507-811d-778ee8ec9ac4
88
---
99

10-
# VM agent is provisioned automatically
10+
# Virtual Machine agent is not provisioned
1111

1212
## SYNOPSIS
1313

14-
Ensure the VM agent is provisioned automatically.
14+
Virtual Machines (VMs) without an agent provisioned are unable to use monitoring, management, and security extensions.
1515

1616
## DESCRIPTION
1717

1818
The virtual machine (VM) agent is required for most functionality that interacts with the guest operating system.
19+
This includes any VMs extensions such as Azure monitoring, management, and security features.
1920

20-
VM extensions help reduce management overhead by providing an entry point to bootstrap monitoring and configuration of the guest operating system.
21-
The VM agent is required to use any VM extensions.
21+
Extensions help reduce management overhead by providing an entry point to bootstrap VM monitoring and configuration.
22+
23+
By default, the VM agent is provisioned for all supported operating systems.
2224

2325
## RECOMMENDATION
2426

25-
Automatically provision the VM agent for all supported operating systems, this is the default.
27+
Consider automatically provisioning the VM agent for all supported operating systems to reduce management overhead of VMs.
28+
29+
## EXAMPLES
30+
31+
### Configure with Azure template
32+
33+
To deploy VMs that pass this rule:
34+
35+
- Set the `properties.osProfile.linuxConfiguration.provisionVMAgent` property to `true` for Linux VMs.
36+
- Set the `properties.osProfile.windowsConfiguration.provisionVMAgent` property to `true` for Windows VMs.
37+
38+
For example:
39+
40+
```json
41+
{
42+
"type": "Microsoft.Compute/virtualMachines",
43+
"apiVersion": "2024-03-01",
44+
"name": "[parameters('name')]",
45+
"location": "[parameters('location')]",
46+
"identity": {
47+
"type": "SystemAssigned"
48+
},
49+
"properties": {
50+
"hardwareProfile": {
51+
"vmSize": "Standard_D8d_v5"
52+
},
53+
"osProfile": {
54+
"computerName": "[parameters('name')]",
55+
"adminUsername": "[parameters('adminUsername')]",
56+
"linuxConfiguration": {
57+
"provisionVMAgent": true,
58+
"disablePasswordAuthentication": true
59+
}
60+
},
61+
"storageProfile": {
62+
"imageReference": {
63+
"publisher": "MicrosoftCblMariner",
64+
"offer": "Cbl-Mariner",
65+
"sku": "cbl-mariner-2-gen2",
66+
"version": "latest"
67+
},
68+
"osDisk": {
69+
"name": "[format('{0}-disk0', parameters('name'))]",
70+
"caching": "ReadWrite",
71+
"createOption": "FromImage",
72+
"managedDisk": {
73+
"storageAccountType": "Premium_LRS"
74+
}
75+
}
76+
},
77+
"networkProfile": {
78+
"networkInterfaces": [
79+
{
80+
"id": "[resourceId('Microsoft.Network/networkInterfaces', parameters('nicName'))]"
81+
}
82+
]
83+
}
84+
},
85+
"zones": [
86+
"1"
87+
],
88+
"dependsOn": [
89+
"[resourceId('Microsoft.Network/networkInterfaces', parameters('nicName'))]"
90+
]
91+
}
92+
```
93+
94+
### Configure with Bicep
95+
96+
To deploy VMs that pass this rule:
97+
98+
- Set the `properties.osProfile.linuxConfiguration.provisionVMAgent` property to `true` for Linux VMs.
99+
- Set the `properties.osProfile.windowsConfiguration.provisionVMAgent` property to `true` for Windows VMs.
100+
101+
For example:
102+
103+
```bicep
104+
resource linux 'Microsoft.Compute/virtualMachines@2024-03-01' = {
105+
name: name
106+
location: location
107+
identity: {
108+
type: 'SystemAssigned'
109+
}
110+
properties: {
111+
hardwareProfile: {
112+
vmSize: 'Standard_D8d_v5'
113+
}
114+
osProfile: {
115+
computerName: name
116+
adminUsername: adminUsername
117+
linuxConfiguration: {
118+
provisionVMAgent: true
119+
disablePasswordAuthentication: true
120+
}
121+
}
122+
storageProfile: {
123+
imageReference: {
124+
publisher: 'MicrosoftCblMariner'
125+
offer: 'Cbl-Mariner'
126+
sku: 'cbl-mariner-2-gen2'
127+
version: 'latest'
128+
}
129+
osDisk: {
130+
name: '${name}-disk0'
131+
caching: 'ReadWrite'
132+
createOption: 'FromImage'
133+
managedDisk: {
134+
storageAccountType: 'Premium_LRS'
135+
}
136+
}
137+
}
138+
networkProfile: {
139+
networkInterfaces: [
140+
{
141+
id: nic.id
142+
}
143+
]
144+
}
145+
}
146+
zones: [
147+
'1'
148+
]
149+
}
150+
```
151+
152+
## NOTES
153+
154+
In general provisioning the VM agent is recommended for all supported operating systems.
155+
For network virtual appliances (NVAs) or specialized unsupported OS images installed from the Azure Marketplace,
156+
the VM agent may be disabled by the publisher.
26157

27158
## LINKS
28159

160+
- [OE:10 Automation design](https://learn.microsoft.com/azure/well-architected/operational-excellence/enable-automation)
29161
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.compute/virtualmachines)

0 commit comments

Comments
 (0)