Package: cloud-guardrails
Cloud GuardrailsCloud Guardrails allows you to rapidly cherry-pick cloud security guardrails by generating Terraform files that create Azure Policy Initiatives.Table of contentsOverviewCheatsheetInstallationTutorialExample: No ParametersExample: Single ServiceExample: ParametersPolicy Characteristics and Support StatusesContributingSetupOther tasksAuthors and ContributorsReferencesOverviewAzure Policies- similar toAWS Service Control Policies (SCPs)- allows Azure customers to enforce organizational standards and enforce security policies at scale. You can use Azure Policies to evaluate the overall state of your environment, and drill down to the security status per resource and per policy.For example, you can prevent users from creating any unencrypted resources or security group rules that allow SSH/RDP Access to 0.0.0.0/0.Azure provides400+ built-in security policies. This presents an incredible opportunity for customers who want to enforce preventative security guardrails from the start. However, deciding which of the 400+ built-in policies you want to enforce, and which stages you want to roll them out in can be a bit intimidating at the start.To help maximize coverage and ease the rollout process, I created this tool so that you can:Cherry-pick and bulk-select the security policies you wantaccording to your specific criteriaEnforce low-friction policies withinminutesEasily roll back policies that you don't wantCheatsheetQuick start# Install Terraform (prerequisite)brewinstalltfenv
tfenvinstall0.12.31# Install via pippip3installcloud-guardrails--user# Generate Terraform to create security guardrails (audit mode only)cloud-guardrailsgenerate-terraform--no-params--subscriptionexample# Generate Terraform to prevent insecure resources from being created (deny mode)cloud-guardrailsgenerate-terraform--no-params--subscriptionexample--enforce# Log into Azure and set your subscriptionazlogin
azaccountset--subscriptionexample# Apply the policiesterraforminit
terraformplan
terraformapply-auto-approveWriting Policies# No Parameterscloud-guardrailsgenerate-terraform--no-params--subscriptionexample# Optional Parameters (i.e., all the policies have default parameter values)cloud-guardrailsgenerate-terraform--params-optional--subscriptionexample# Required Parameterscloud-guardrailsgenerate-terraform--params-required\--serviceKubernetes\--subscriptionexample# Create Config filecloud-guardrailscreate-config-file--outputconfig.yml# Create Parameters filecloud-guardrailscreate-parameters-file--outputparameters.ymlQuerying Policy Data# list-services: List all the services supported by Azure built-in Policies
cloud-guardrails list-services

# list-policies: List all the existing built-in Azure Policies
cloud-guardrails list-policies --service "Kubernetes" --all-policies
cloud-guardrails list-policies --service "Kubernetes" --no-params
cloud-guardrails list-policies --service "Kubernetes" --audit-only

# describe-policy: Describe a specific policy based on display name or the short policy ID
cloud-guardrails describe-policy --id 7c1b1214-f927-48bf-8882-84f0af6588b1
cloud-guardrails describe-policy --name "Storage accounts should use customer-managed key for encryption"InstallationOption 1: Homebrewbrewtapsalesforce/cloud-guardrailshttps://github.com/salesforce/cloud-guardrails
brewinstallcloud-guardrailsOption 2: Pip3pip3install--usercloud-guardrailsTerraformInstall Terraform if you haven't already. I recommend usingtfenv, a Terraform version manager:brewinstalltfenv
tfenvinstall0.12.31Now you can follow the rest of the tutorial.TutorialExample: No ParametersFirst, log into Azure and set your subscriptionazlogin
azaccountset--subscriptionmy-subscriptionThen generate the Terraform files:cloud-guardrailsgenerate-terraform--no-params\--subscriptionexampleNavigate to the Terraform directory and apply the policies:cdexamples/terraform-demo/
terraforminit
terraformplan
terraformapply-auto-approveThe output will look like this:It will generate a file calledno_params.tf. The file contents will look like this:examples/terraform-demo-no-params/main.tf.Example: Single ServiceYou can also generate policies for a single service. Consider the example below where we generate Terraform for Key Vault only:cloud-guardrailsgenerate-terraform--no-params\--service"Key Vault"\--subscriptionexampleClick to expand!locals{name_no_params="example_NP_Audit"subscription_name_no_params="example"management_group_no_params=""enforcement_mode_no_params=falsepolicy_ids_no_params=[# -----------------------------------------------------------------------------------------------------------------# Key Vault# -----------------------------------------------------------------------------------------------------------------"c39ba22d-4428-4149-b981-70acb31fc383",# Azure Key Vault Managed HSM should have purge protection enabled"0b60c0b2-2dc2-4e1c-b5c9-abbed971de53",# Key vaults should have purge protection enabled"1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d",# Key vaults should have soft delete enabled"55615ac9-af46-4a59-874e-391cc3dfb490",# Firewall should be enabled on Key Vault"152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0",# Key Vault keys should have an expiration date"98728c90-32c7-4049-8429-847dc0f4fe37",# Key Vault secrets should have an expiration date"587c79fe-dd04-4a5e-9d0b-f89598c7261b",# Keys should be backed by a hardware security module (HSM)"5f0bc445-3935-4915-9981-011aa2b46147",# Private endpoint should be configured for Key Vault"75262d3e-ba4a-4f43-85f8-9f72c090e5e3",# Secrets should have content type set]}# ---------------------------------------------------------------------------------------------------------------------# Azure Policy name lookups:# Because the policies are built-in, we can just look up their IDs by their names.# ---------------------------------------------------------------------------------------------------------------------data"azurerm_policy_definition""no_params"{count=length(local.policy_ids_no_params)name=element(local.policy_ids_no_params,count.index)}locals{no_params_policy_definitions=flatten([tolist([fordefinitionindata.azurerm_policy_definition.no_params.*.id:map("policyDefinitionId",definition)])])}# ---------------------------------------------------------------------------------------------------------------------# Conditional data lookups: If the user supplies management group, look up the ID of the management group# ---------------------------------------------------------------------------------------------------------------------data"azurerm_management_group""no_params"{count=local.management_group_no_params!=""?1:0display_name=local.management_group_no_params}### If the user supplies subscription, look up the ID of the subscriptiondata"azurerm_subscriptions""no_params"{count=local.subscription_name_no_params!=""?1:0display_name_contains=local.subscription_name_no_params}locals{no_params_scope=local.management_group_no_params!=""?data.azurerm_management_group.no_params[0].id:element(data.azurerm_subscriptions.no_params[0].subscriptions.*.id,0)}# ---------------------------------------------------------------------------------------------------------------------# Policy Initiative# ---------------------------------------------------------------------------------------------------------------------resource"azurerm_policy_set_definition""no_params"{name=local.name_no_paramspolicy_type="Custom"display_name=local.name_no_paramsdescription=local.name_no_paramsmanagement_group_name=local.management_group_no_params==""?null:local.management_group_no_paramspolicy_definitions=tostring(jsonencode(local.no_params_policy_definitions))metadata=tostring(jsonencode({category=local.name_no_params}))}# ---------------------------------------------------------------------------------------------------------------------# Azure Policy Assignments# Apply the Policy Initiative to the specified scope# ---------------------------------------------------------------------------------------------------------------------resource"azurerm_policy_assignment""no_params"{name=local.name_no_paramspolicy_definition_id=azurerm_policy_set_definition.no_params.idscope=local.no_params_scopeenforcement_mode=local.enforcement_mode_no_params}# ---------------------------------------------------------------------------------------------------------------------# Outputs# ---------------------------------------------------------------------------------------------------------------------output"no_params_policy_assignment_ids"{value=azurerm_policy_assignment.no_params.iddescription="The IDs of the Policy Assignments."}output"no_params_scope"{value=local.no_params_scopedescription="The target scope - either the management group or subscription, depending on which parameters were supplied"}output"no_params_policy_set_definition_id"{value=azurerm_policy_set_definition.no_params.iddescription="The ID of the Policy Set Definition."}output"no_params_count_of_policies_applied"{description="The number of Policies applied as part of the Policy Initiative"value=length(local.policy_ids_no_params)}Example: ParametersBackground and MotivationAzure Parameters are similar to fields on a form -name,address,city,state. These parameters always stay the same, however their values change based on the individual filling out the form. Parameters work the same way when building policies. By including parameters in a policy definition, you can reuse that policy for different scenarios by using different values.However,the process that Microsoft lays out for managing Policy as Code workflowsis less preferable to some, due to the amount of policy files and the lack of a single view of parameters. Their documentation suggests this file structure for laying out your policy files and parameters..
|
|- policies/  ________________________ # Root folder for policy resources
|  |- policy1/  ______________________ # Subfolder for a policy
|     |- policy.json _________________ # Policy definition
|     |- policy.parameters.json ______ # Policy definition of parameters
|     |- policy.rules.json ___________ # Policy rule
|     |- assign.<name1>.json _________ # Assignment 1 for this policy definition
|     |- assign.<name2>.json _________ # Assignment 2 for this policy definition
|  |- policy2/  ______________________ # Subfolder for a policy
|     |- policy.json _________________ # Policy definition
|     |- policy.parameters.json ______ # Policy definition of parameters
|     |- policy.rules.json ___________ # Policy rule
|     |- assign.<name1>.json _________ # Assignment 1 for this policy definition
|     |- assign.<name2>.json _________ # Assignment 2 for this policy definition
|That's a lot of JSON, and a lot of clicks.cloud-guardrailsoffers a more elegant solution. You can specify your paramters in the form of a YAML file. The YAML file allows you to modify the parameters per policy in a fine-grained manner. Additionally, you don't have to write the parameters file yourself! Just run thecreate-parameters-filecommand, and it will create the file for you. You just have to fill in the values like a form.Let's take a tour.Parameters tutorialGenerate the parameters file:cloud-guardrailscreate-parameters-file\--optional-only\-oparameters-optional.ymlThe generatedparameters-optional.ymlfile will only contain policies that have parameters with default values. The policies are sorted by service for improved readability. Consider the snippet below from the Key Vault section:# ---------------------------------------------------------------------------------------------------------------------# Key Vault# ---------------------------------------------------------------------------------------------------------------------Key Vault:"ResourcelogsinKeyVaultshouldbeenabled":effect:AuditIfNotExists# Allowed: ["AuditIfNotExists", "Disabled"]requiredRetentionDays:365"[Preview]:Certificatesshouldbeissuedbythespecifiedintegratedcertificateauthority":allowedCAs:-DigiCert-GlobalSign# Allowed: ["DigiCert", "GlobalSign"]effect:audit# Allowed: ["audit", "deny", "disabled"]"[Preview]:Certificatesshouldhavethespecifiedmaximumvalidityperiod":maximumValidityInMonths:12effect:audit# Allowed: ["audit", "deny", "disabled"]Notice how some parameters only allow specific values. For example, the policy named"Certificates should be issued by the specified integrated certificate authority"has a parameter calledallowedCAs. However, you can't just provideanyvalue to that parameter - it has to be one of two allowed values.cloud-guardrailssimplifies this process by including the allowed values in the comments -# Allowed: ["DigiCert", "GlobalSign"].Now let's generate Terraform using this parameters file. Run the following command:cloud-guardrailsgenerate-terraform--params-optional\-s"Key Vault"\--subscriptionexample\-pparameters-optional.ymlObserve that the output will include the parameters that you supplied in your config file:Click to expand!locals{name_example_PO_Audit="example_PO_Audit"subscription_name_example_PO_Audit="example"management_group_example_PO_Audit=""category_example_PO_Audit="Testing"enforcement_mode_example_PO_Audit=falsepolicy_ids_example_PO_Audit=[# -----------------------------------------------------------------------------------------------------------------# Key Vault# -----------------------------------------------------------------------------------------------------------------"a2a5b911-5617-447e-a49e-59dbe0e0434b",# Resource logs in Azure Key Vault Managed HSM should be enabled"cf820ca0-f99e-4f3e-84fb-66e913812d21",# Resource logs in Key Vault should be enabled"8e826246-c976-48f6-b03e-619bb92b3d82",# Certificates should be issued by the specified integrated certificate authority"0a075868-4c26-42ef-914c-5bc007359560",# Certificates should have the specified maximum validity period"1151cede-290b-4ba0-8b38-0ad145ac888f",# Certificates should use allowed key types"bd78111f-4953-4367-9fd5-7e08808b54bf",# Certificates using elliptic curve cryptography should have allowed curve names"75c4f823-d65c-4f29-a733-01d0077fdbcb",# Keys should be the specified cryptographic type RSA or EC"ff25f3c8-b739-4538-9d07-3d6d25cfb255",# Keys using elliptic curve cryptography should have the specified curve names]policy_definition_map={"Resource logs in Azure Key Vault Managed HSM should be enabled" = "/providers/Microsoft.Authorization/policyDefinitions/a2a5b911-5617-447e-a49e-59dbe0e0434b","Resource logs in Key Vault should be enabled" = "/providers/Microsoft.Authorization/policyDefinitions/cf820ca0-f99e-4f3e-84fb-66e913812d21","Certificates should be issued by the specified integrated certificate authority" = "/providers/Microsoft.Authorization/policyDefinitions/8e826246-c976-48f6-b03e-619bb92b3d82","Certificates should have the specified maximum validity period" = "/providers/Microsoft.Authorization/policyDefinitions/0a075868-4c26-42ef-914c-5bc007359560","Certificates should use allowed key types" = "/providers/Microsoft.Authorization/policyDefinitions/1151cede-290b-4ba0-8b38-0ad145ac888f","Certificates using elliptic curve cryptography should have allowed curve names" = "/providers/Microsoft.Authorization/policyDefinitions/bd78111f-4953-4367-9fd5-7e08808b54bf","Keys should be the specified cryptographic type RSA or EC" = "/providers/Microsoft.Authorization/policyDefinitions/75c4f823-d65c-4f29-a733-01d0077fdbcb","Keys using elliptic curve cryptography should have the specified curve names" = "/providers/Microsoft.Authorization/policyDefinitions/ff25f3c8-b739-4538-9d07-3d6d25cfb255",}}# ---------------------------------------------------------------------------------------------------------------------# Conditional data lookups: If the user supplies management group, look up the ID of the management group# ---------------------------------------------------------------------------------------------------------------------data"azurerm_management_group""example_PO_Audit"{count=local.management_group_example_PO_Audit!=""?1:0display_name=local.management_group_example_PO_Audit}### If the user supplies subscription, look up the ID of the subscriptiondata"azurerm_subscriptions""example_PO_Audit"{count=local.subscription_name_example_PO_Audit!=""?1:0display_name_contains=local.subscription_name_example_PO_Audit}locals{scope=local.management_group_example_PO_Audit!=""?data.azurerm_management_group.example_PO_Audit[0].id:element(data.azurerm_subscriptions.example_PO_Audit[0].subscriptions.*.id,0)}# ---------------------------------------------------------------------------------------------------------------------# Azure Policy Definition Lookups# ---------------------------------------------------------------------------------------------------------------------data"azurerm_policy_definition""example_PO_Audit_definition_lookups"{count=length(local.policy_ids_example_PO_Audit)name=local.policy_ids_example_PO_Audit[count.index]}# ---------------------------------------------------------------------------------------------------------------------# Azure Policy Initiative Definition# ---------------------------------------------------------------------------------------------------------------------resource"azurerm_policy_set_definition""example_PO_Audit"{name=local.name_example_PO_Auditpolicy_type="Custom"display_name=local.name_example_PO_Auditdescription=local.name_example_PO_Auditmanagement_group_name=local.management_group_example_PO_Audit==""?null:local.management_group_example_PO_Auditmetadata=tostring(jsonencode({category=local.category_example_PO_Audit}))policy_definition_reference{policy_definition_id=lookup(local.policy_definition_map,"Resource logs in Azure Key Vault Managed HSM should be enabled")parameter_values=jsonencode({effect={"value":"AuditIfNotExists"}requiredRetentionDays={"value":"365"}})reference_id=null}policy_definition_reference{policy_definition_id=lookup(local.policy_definition_map,"Resource logs in Key Vault should be enabled")parameter_values=jsonencode({effect={"value":"AuditIfNotExists"}requiredRetentionDays={"value":"365"}})reference_id=null}policy_definition_reference{policy_definition_id=lookup(local.policy_definition_map,"Certificates should be issued by the specified integrated certificate authority")parameter_values=jsonencode({allowedCAs={"value":["DigiCert", "GlobalSign"]}effect={"value":"audit"}})reference_id=null}policy_definition_reference{policy_definition_id=lookup(local.policy_definition_map,"Certificates should have the specified maximum validity period")parameter_values=jsonencode({maximumValidityInMonths={"value":12}effect={"value":"audit"}})reference_id=null}policy_definition_reference{policy_definition_id=lookup(local.policy_definition_map,"Certificates should use allowed key types")parameter_values=jsonencode({allowedKeyTypes={"value":["RSA", "RSA-HSM"]}effect={"value":"audit"}})reference_id=null}policy_definition_reference{policy_definition_id=lookup(local.policy_definition_map,"Certificates using elliptic curve cryptography should have allowed curve names")parameter_values=jsonencode({allowedECNames={"value":["P-256", "P-256K", "P-384", "P-521"]}effect={"value":"audit"}})reference_id=null}policy_definition_reference{policy_definition_id=lookup(local.policy_definition_map,"Keys should be the specified cryptographic type RSA or EC")parameter_values=jsonencode({allowedKeyTypes={"value":["RSA", "RSA-HSM", "EC", "EC-HSM"]}effect={"value":"Audit"}})reference_id=null}policy_definition_reference{policy_definition_id=lookup(local.policy_definition_map,"Keys using elliptic curve cryptography should have the specified curve names")parameter_values=jsonencode({allowedECNames={"value":["P-256", "P-256K", "P-384", "P-521"]}effect={"value":"Audit"}})reference_id=null}}# ---------------------------------------------------------------------------------------------------------------------# Azure Policy Assignments# Apply the Policy Initiative to the specified scope# ---------------------------------------------------------------------------------------------------------------------resource"azurerm_policy_assignment""example_PO_Audit"{name=local.name_example_PO_Auditpolicy_definition_id=azurerm_policy_set_definition.example_PO_Audit.idscope=local.scopeenforcement_mode=local.enforcement_mode_example_PO_Audit}# ---------------------------------------------------------------------------------------------------------------------# Outputs# ---------------------------------------------------------------------------------------------------------------------output"example_PO_Audit_policy_assignment_ids"{value=azurerm_policy_assignment.example_PO_Audit.iddescription="The IDs of the Policy Assignments."}output"example_PO_Audit_scope"{value=local.scopedescription="The target scope - either the management group or subscription, depending on which parameters were supplied"}output"example_PO_Audit_policy_set_definition_id"{value=azurerm_policy_set_definition.example_PO_Audit.iddescription="The ID of the Policy Set Definition."}Tutorial: Selecting Policies using the Config FileLet's say that you want more granular control over which policies to apply. You can create a config file to manage this.To create the config file, run the following command:# Create Config filecloud-guardrailscreate-config-file--outputconfig.ymlThis generates a file calledconfig.ymlwith the following contents:Click to expand!##### match_only_keywords: Use this to only apply policies that match any of these keywords# exclude_keywords: Use this to skip policies that have any of these keywords in the display name# exclude_services: Specify services that you want to exclude entirely.# exclude_policies: Specify Azure Policy Definition displayNames that you want to exclude from the results, sorted by service##### Use this to only apply policies that match any of these keywords# Example: "encrypt", "SQL", "HTTP"match_only_keywords:-""exclude_keywords:-""-"virtualnetworkserviceendpoint"#- "private link"# Specify services that you want to exclude entirely.# Uncomment the services mentioned below if you want to exclude them.exclude_services:-""-"GuestConfiguration"#- "API Management"#- "API for FHIR"#- "App Configuration"#- "App Platform"#- "App Service"#- "Attestation"#- "Automanage"#- "Automation"#- "Azure Active Directory"#- "Azure Data Explorer"#- "Azure Stack Edge"#- "Backup"#- "Batch"#- "Bot Service"#- "Cache"#- "Cognitive Services"#- "Compute"#- "Container Instance"#- "Container Registry"#- "Cosmos DB"#- "Custom Provider"#- "Data Box"#- "Data Factory"#- "Data Lake"#- "Event Grid"#- "Event Hub"#- "General"#- "HDInsight"#- "Internet of Things"#- "Key Vault"#- "Kubernetes"#- "Kubernetes service"#- "Lighthouse"#- "Logic Apps"#- "Machine Learning"#- "Managed Application"#- "Media Services"#- "Migrate"#- "Monitoring"#- "Network"#- "Portal"#- "SQL"#- "Search"#- "Security Center"#- "Service Bus"#- "Service Fabric"#- "SignalR"#- "Site Recovery"#- "Storage"#- "Stream Analytics"#- "Synapse"#- "Tags"#- "VM Image Builder"#- "Web PubSub"# Specify Azure Policy Definition displayNames that you want to exclude from the resultsexclude_policies:General:-"AllowresourcecreationonlyinAsiadatacenters"-"AllowresourcecreationonlyinEuropeandatacenters"-"AllowresourcecreationonlyinIndiadatacenters"-"AllowresourcecreationonlyinUnitedStatesdatacenters"Tags:-"Allowresourcecreationif'department'tagset"-"Allowresourcecreationif'environment'tagvalueinallowedvalues"API Management:# This collides with the same one from App Platform-"APIManagementservicesshoulduseavirtualnetwork"App Platform:# This collides with the same one from API Management-"AzureSpringCloudshouldusenetworkinjection"Guest Configuration:# This outputs a parameter called "Cert:" that breaks the parameter yaml format-"AuditWindowsmachinesthatcontaincertificatesexpiringwithinthespecifiednumberofdays"Network:# This one is overly cumbersome for most organizations-"NetworkinterfacesshouldnothavepublicIPs"API for FHIR:-""App Configuration:-""App Service:-""Attestation:-""Automanage:-""Automation:-""Azure Active Directory:-""Azure Data Explorer:-""Azure Stack Edge:-""Backup:-""Batch:-""Bot Service:-""Cache:-""Cognitive Services:-""Compute:-""Container Instance:-""Container Registry:-""Cosmos DB:-""Custom Provider:-""Data Box:-""Data Factory:-""Data Lake:-""Event Grid:-""Event Hub:-""HDInsight:-""Internet of Things:-""Key Vault:-""Kubernetes:-""Kubernetes service:-""Lighthouse:-""Logic Apps:-""Machine Learning:-""Managed Application:-""Media Services:-""Migrate:-""Monitoring:-""Portal:-""SQL:-""Search:-""Security Center:-""Service Bus:-""Service Fabric:-""SignalR:-""Site Recovery:-""Storage:-""Stream Analytics:-""Synapse:-""VM Image Builder:-""Web PubSub:-""It has a few different sections, which we cover below.Matching KeywordsIf you want to select policies based on the keywords of the policy name, you can insert those keywords in thematch_only_keywordslist in theconfig.ymlfile. For example, let's say you only want to apply the SQL-related policies:match_only_keywords:-"SQL"Don't know the names of the policies?If you want to show the names of all the policies, you can use thelist-policiescommand to list all of them. You can also filter the results based on which service or whether parameters are required, optional, or not required:cloud-guardrailslist-policies--service"Kubernetes"--all-policies
cloud-guardrailslist-policies--service"Kubernetes"--no-params
cloud-guardrailslist-policies--service"Kubernetes"--audit-onlyExcluding Policies based on KeywordsLet's say that you don't want to apply any of the policies that mention Private Link or Virtual Network Service Endpoints. You can insert those keywords in theexclude_keywordslist to skip policies that have any of these keywords in the display name:exclude_keywords:-"virtualnetworkserviceendpoint"-"privatelink"Don't know the names of the policies?If you want to show the names of all the policies, you can use thelist-policiescommand to list all of them. You can also filter the results based on which service or whether parameters are required/optional/not required:cloud-guardrailslist-policies--service"Kubernetes"--all-policies
cloud-guardrailslist-policies--service"Kubernetes"--no-params
cloud-guardrailslist-policies--service"Kubernetes"--audit-onlyExcluding specific policiesIf you want to exclude specific policies entirely, you can specify the display names for those policies that you want to exclude using theexclude_policieslist, like below:exclude_policies:General:-"AllowresourcecreationonlyinAsiadatacenters"-"AllowresourcecreationonlyinEuropeandatacenters"-"AllowresourcecreationonlyinIndiadatacenters"-"AllowresourcecreationonlyinUnitedStatesdatacenters"Don't know the names of the policies?If you don't know the names of the services to include, you can use thelist-policiescommand to list all the services supported by Azure built-in Policies:cloud-guardrailslist-policies--service"Kubernetes"--all-policies
cloud-guardrailslist-policies--service"Kubernetes"--no-params
cloud-guardrailslist-policies--service"Kubernetes"--audit-onlyPolicy Characteristics and Support StatusesCharacteristicSupportDescriptionParametersPolicies withNo Parameters✅These policies do not require any parameters. These are the easiest policies to apply.Policies withOptional Parameters✅These policies allow the use of parameters, but the parameters have default values. These are easy to apply at first, but you will likely want to adjust the parameters throughout the lifecycle.Policies withRequired Parameters✅These policies require parameters which do not have default values. While rollout is significantly less time consuming than the Azure recommended workflow, finding the best values for your environment requires careful thinking.EffectsPolicies with"Deny" Effects✅These Policies block bad actions, acting as true guardrails.Policies with"Audit" Effects✅These Policies do not actually prevent bad actions, even if “enforcement mode” is set to True - they just flag the bad actions.Policies with"Deploy" Effects❌Some Azure Policies haveDeployIfNotExistseffects, which create resources via an ARM Template when the condition is met. For example, the policy "Deploy network watcher when virtual networks are created" will create a resource group called networkWatcherRG.Policies with"Modify" Effects❌Some Azure Policies havePolicy Effectsthat allow the modification of resources, such as the "Modify" or "Append" effects.Built-in vs. CustomBuilt-in Policies✅Microsoft provides 400+ built-in policy definitions. cloud-guardrails leverages these Built-in Policy definitions so you can get rapidly started and maximize your coverage.Custom Policies❌cloud-guardrails does not support creation of Custom Policies. Consider leveraging Custom Policies after you have built out your process and workflow using cloud-guardrails.ContributingSetupSet up the virtual environment# Set up the virtual environmentpython3-mvenv./venv&&sourcevenv/bin/activate
pip3install-rrequirements.txtBuild the package# To build onlymakebuild# To build and installmakeinstall# To run testsmaketest# To clean local dev environmentmakecleanOther tasksUpdate with the latest Azure Compliance datamakeupdate-dataUpdate the policy summary tablesmakeupdate-policy-tableUpdate the Azure Policy Git submodule and merge it# Without mergemakeupdate-submodule# With mergemakeupdate-submodule-with-mergeAuthors and ContributorsKinnaird McQuade (@kmcquade3), Salesforce - AuthorReferencesAzure Policy Definition StructureAzure Policy ParametersAzure Policy Assignment StructureAuthorization Schemas