Skip to content

Commit a918c89

Browse files
garycentricgarycentric
authored
Merge pull request #113530 from jomolesk/asb02
Add ASB blueprint content
2 parents e891f94 + 1c42ea9 commit a918c89

File tree

4 files changed

+195
-1
lines changed

4 files changed

+195
-1
lines changed

‎articles/governance/blueprints/samples/azure-security-benchmark/control-mapping.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ms.topic: sample
88

99
The following article details how the Azure Blueprints Azure Security Benchmark
1010
blueprint sample maps to the Azure Security Benchmark controls. For more
11-
information about the controls, see [Azure Security Benchmark](https://docs.microsoft.com/azure/security/benchmarks/overview).
11+
information about the controls, see [Azure Security Benchmark](../../../../security/benchmarks/overview.md).
1212

1313
The following mappings are to the **Azure Security Benchmark** controls. Use the navigation on the
1414
right to jump directly to a specific control mapping. The mapped controls are implemented with an

‎articles/governance/blueprints/samples/azure-security-benchmark/deploy.md

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
---
2+
title: Deploy Azure Security Benchmark blueprint sample
3+
description: Deploy steps for the Azure Security Benchmark blueprint sample including blueprint artifact parameter details.
4+
ms.date: 05/01/2020
5+
ms.topic: sample
6+
---
7+
# Deploy the Azure Security Benchmark blueprint sample
8+
9+
To deploy the Azure Blueprints Azure Security Benchmark blueprint sample, the following steps must
10+
be taken:
11+
12+
> [!div class="checklist"]
13+
> - Create a new blueprint from the sample
14+
> - Mark your copy of the sample as **Published**
15+
> - Assign your copy of the blueprint to an existing subscription
16+
17+
If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free)
18+
before you begin.
19+
20+
## Create blueprint from sample
21+
22+
First, implement the blueprint sample by creating a new blueprint in your environment using the
23+
sample as a starter.
24+
25+
1. Select **All services** in the left pane. Search for and select **Blueprints**.
26+
27+
1. From the **Getting started** page on the left, select the **Create** button under _Create a
28+
blueprint_.
29+
30+
1. Find the **Azure Security Benchmark** blueprint sample under _Other Samples_ and select click the
31+
name to select this sample.
32+
33+
1. Enter the _Basics_ of the blueprint sample:
34+
35+
- **Blueprint name**: Provide a name for your copy of the Azure Security Benchmark blueprint
36+
sample.
37+
- **Definition location**: Use the ellipsis and select the management group to save your copy of
38+
the sample to.
39+
40+
1. Select the _Artifacts_ tab at the top of the page or **Next: Artifacts** at the bottom of the
41+
page.
42+
43+
1. Review the list of artifacts that make up the blueprint sample. Many of the artifacts have
44+
parameters that we'll define later. Select **Save Draft** when you've finished reviewing the
45+
blueprint sample.
46+
47+
## Publish the sample copy
48+
49+
Your copy of the blueprint sample has now been created in your environment. It's created in
50+
**Draft** mode and must be **Published** before it can be assigned and deployed. The copy of the
51+
blueprint sample can be customized to your environment and needs, but that modification may move
52+
it away from alignment with Azure Security Benchmark recommendations.
53+
54+
1. Select **All services** in the left pane. Search for and select **Blueprints**.
55+
56+
1. Select the **Blueprint definitions** page on the left. Use the filters to find your copy of the
57+
blueprint sample and then select it.
58+
59+
1. Select **Publish blueprint** at the top of the page. In the new page on the right, provide a
60+
**Version** for your copy of the blueprint sample. This property is useful for if you make a
61+
modification later. Provide **Change notes** such as "First version published from the Azure
62+
Security Benchmark blueprint sample." Then select **Publish** at the bottom of the page.
63+
64+
## Assign the sample copy
65+
66+
Once the copy of the blueprint sample has been successfully **Published**, it can be assigned to a
67+
subscription within the management group it was saved to. This step is where parameters are
68+
provided to make each deployment of the copy of the blueprint sample unique.
69+
70+
1. Select **All services** in the left pane. Search for and select **Blueprints**.
71+
72+
1. Select the **Blueprint definitions** page on the left. Use the filters to find your copy of the
73+
blueprint sample and then select it.
74+
75+
1. Select **Assign blueprint** at the top of the blueprint definition page.
76+
77+
1. Provide the parameter values for the blueprint assignment:
78+
79+
- Basics
80+
81+
- **Subscriptions**: Select one or more of the subscriptions that are in the management group
82+
you saved your copy of the blueprint sample to. If you select more than one subscription, an
83+
assignment will be created for each using the parameters entered.
84+
- **Assignment name**: The name is pre-populated for you based on the name of the blueprint.
85+
Change as needed or leave as is.
86+
- **Location**: Select a region for the managed identity to be created in. Azure Blueprint uses
87+
this managed identity to deploy all artifacts in the assigned blueprint. To learn more, see
88+
[managed identities for Azure resources](../../../../active-directory/managed-identities-azure-resources/overview.md).
89+
- **Blueprint definition version**: Pick a **Published** version of your copy of the blueprint
90+
sample.
91+
92+
- Lock Assignment
93+
94+
Select the blueprint lock setting for your environment. For more information, see [blueprints resource locking](../../concepts/resource-locking.md).
95+
96+
- Managed Identity
97+
98+
Leave the default _system assigned_ managed identity option.
99+
100+
- Artifact parameters
101+
102+
The parameters defined in this section apply to the artifact under which it's defined. These
103+
parameters are [dynamic parameters](../../concepts/parameters.md#dynamic-parameters) since
104+
they're defined during the assignment of the blueprint. For a full list or artifact parameters
105+
and their descriptions, see [Artifact parameters table](#artifact-parameters-table).
106+
107+
1. Once all parameters have been entered, select **Assign** at the bottom of the page. The blueprint
108+
assignment is created and artifact deployment begins. Deployment takes roughly an hour. To check
109+
on the status of deployment, open the blueprint assignment.
110+
111+
> [!WARNING]
112+
> The Azure Blueprints service and the built-in blueprint samples are **free of cost**. Azure
113+
> resources are [priced by product](https://azure.microsoft.com/pricing/). Use the [pricing calculator](https://azure.microsoft.com/pricing/calculator/)
114+
> to estimate the cost of running resources deployed by this blueprint sample.
115+
116+
## Artifact parameters table
117+
118+
The following table provides a list of the blueprint artifact parameters:
119+
120+
|Artifact name|Artifact type|Parameter name|Description|
121+
|-|-|-|-|
122+
|Audit Azure Security Benchmark recommendations and deploy specific supporting VM Extensions|Policy assignment|
123+
List of users excluded from Windows VM Administrators group|A semicolon-separated list of members that should be excluded in the Administrators local group. Ex: Administrator; myUser1; myUser2|
124+
|Audit Azure Security Benchmark recommendations and deploy specific supporting VM Extensions|Policy assignment|List of users that must be included in Windows VM Administrators group|A semicolon-separated list of members that should be included in the Administrators local group. Ex: Administrator; myUser1; myUser2|
125+
|Audit Azure Security Benchmark recommendations and deploy specific supporting VM Extensions|Policy assignment|List of users that Windows VM Administrators group must *only* include|A semicolon-separated list of all the expected members of the Administrators local group. Ex: Administrator; myUser1; myUser2|
126+
|Audit Azure Security Benchmark recommendations and deploy specific supporting VM Extensions|Policy assignment|List of regions where Network Watcher should be enabled|To see a complete list of regions use Get-AzLocation|
127+
|Audit Azure Security Benchmark recommendations and deploy specific supporting VM Extensions|Policy assignment|Virtual network where VMs should be connected|Example: /subscriptions/YourSubscriptionId/resourceGroups/YourResourceGroupName/providers/Microsoft.Network/virtualNetworks/Name|
128+
|Audit Azure Security Benchmark recommendations and deploy specific supporting VM Extensions|Policy assignment|Network gateway that virtual networks should use|Example: /subscriptions/YourSubscriptionId/resourceGroups/YourResourceGroup/providers/Microsoft.Network/virtualNetworkGateways/Name|
129+
|Audit Azure Security Benchmark recommendations and deploy specific supporting VM Extensions|Policy assignment|List of workspace IDs where Log Analytics agents should connect|A semicolon-separated list of the workspace IDs that the Log Analytics agent should be connected to|
130+
|Audit Azure Security Benchmark recommendations and deploy specific supporting VM Extensions|Policy assignment|List of resource types that should have diagnostic logs enabled|Audit diagnostic setting for selected resource types|
131+
|Audit Azure Security Benchmark recommendations and deploy specific supporting VM Extensions|Policy assignment|Latest PHP version|Latest supported PHP version for App Services|
132+
|Audit Azure Security Benchmark recommendations and deploy specific supporting VM Extensions|Policy assignment|Latest Java version|Latest supported Java version for App Services|
133+
|Audit Azure Security Benchmark recommendations and deploy specific supporting VM Extensions|Policy assignment|Latest Windows Python version|Latest supported Python version for App Services|
134+
|Audit Azure Security Benchmark recommendations and deploy specific supporting VM Extensions|Policy assignment|Latest Linux Python version|Latest supported Python version for App Services|
135+
136+
## Next steps
137+
138+
Now that you've reviewed the steps to deploy the Azure Security Benchmark blueprint
139+
sample, visit the following articles to learn about the blueprint and control mapping:
140+
141+
> [!div class="nextstepaction"]
142+
> [Azure Security Benchmark blueprint - Overview](./index.md)
143+
> [Azure Security Benchmark blueprint - Control mapping](./control-mapping.md)
144+
145+
Addition articles about blueprints and how to use them:
146+
147+
- Learn about the [blueprint lifecycle](../../concepts/lifecycle.md).
148+
- Understand how to use [static and dynamic parameters](../../concepts/parameters.md).
149+
- Learn to customize the [blueprint sequencing order](../../concepts/sequencing-order.md).
150+
- Find out how to make use of [blueprint resource locking](../../concepts/resource-locking.md).
151+
- Learn how to [update existing assignments](../../how-to/update-existing-assignments.md).

‎articles/governance/blueprints/samples/azure-security-benchmark/index.md

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
title: Azure Security Benchmark blueprint sample overview
3+
description: Overview of the Azure Security Benchmark blueprint sample. This blueprint sample helps customers assess specific controls.
4+
ms.date: 05/01/2020
5+
ms.topic: sample
6+
---
7+
# Overview of the Azure Security Benchmark blueprint sample
8+
9+
The Azure Security Benchmark blueprint sample provides governance guard-rails using
10+
[Azure Policy](../../../policy/overview.md) that help you assess specific
11+
[Azure Security Benchmark](../../../../security/benchmarks/overview.md) controls. This blueprint helps
12+
customers deploy a core set of policies for any Azure-deployed architecture where they intend to
13+
implement Azure Security Benchmark controls.
14+
15+
## Control mapping
16+
17+
The control mapping section provides details on policies included within this blueprint and how
18+
these policies address various controls in the Azure Security Benchmark. When assigned to an
19+
architecture, resources are evaluated by Azure Policy for non-compliance with assigned policies. For
20+
more information, see [Azure Policy](../../../policy/overview.md).
21+
22+
## Next steps
23+
24+
You've reviewed the overview and of the Azure Security Benchmark blueprint sample.
25+
Next, visit the following articles to learn about the control mapping:
26+
27+
> [!div class="nextstepaction"]
28+
> [Azure Security Benchmark blueprint - Control mapping](./control-mapping.md)
29+
> [Azure Security Benchmark blueprint - Deploy steps](./deploy.md)
30+
31+
Additional articles about blueprints and how to use them:
32+
33+
- Learn about the [blueprint lifecycle](../../concepts/lifecycle.md).
34+
- Understand how to use [static and dynamic parameters](../../concepts/parameters.md).
35+
- Learn to customize the [blueprint sequencing order](../../concepts/sequencing-order.md).
36+
- Find out how to make use of [blueprint resource locking](../../concepts/resource-locking.md).
37+
- Learn how to [update existing assignments](../../how-to/update-existing-assignments.md).

‎articles/governance/blueprints/toc.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,15 @@
3535
href: ./samples/index.md
3636
- name: Azure Security Benchmark
3737
items:
38+
- name: Overview
39+
displayName: standards, azure, benchmark
40+
href: ./samples/azure-security-benchmark/index.md
3841
- name: Control mapping
3942
displayName: standards, azure, benchmark
4043
href: ./samples/azure-security-benchmark/control-mapping.md
44+
- name: Steps to deploy
45+
displayName: standards, azure, benchmark
46+
href: ./samples/azure-security-benchmark/deploy.md
4147
- name: Australian Government ISM PROTECTED
4248
items:
4349
- name: Control mapping

0 commit comments

Comments
 (0)