Project: Chef InSpec (Provisioning / Security & Compliance)
File: azurerm_security_center_policy.md

+++ title = "azurermsecuritycenter_policy resource" draft = false gh_repo = "inspec" platform = "azure" [menu] [menu.inspec] title = "azurermsecuritycenter_policy" identifier = "inspec/resources/azure/azurermsecuritycenterpolicy.md azurermsecuritycenterpolicy resource" parent = "inspec/resources/azure" +++ {{< inspec/azurermdeprecated resource="azuresecuritycenterpolicy" >}} Use the `azurermsecuritycenter_policy` InSpec audit resource to test properties of the `default` Security Center Policy. Azure currently only supports looking up the `default` policy via their Rest API. If you attempt to look up a different Security Policy you will receive an error. An Azure Security Center Policy defines a set of controls recommended for resources within this subscription. These settings will generate alerts if something is found to violate the recommendations. This resource allows you to inspect what alerts you have configured for your account. This resource interacts with version `2015-06-01-Preview` of the Azure Management API. For more information see the . At the moment, there doesn't appear to be a way to select the version of the Azure API docs. If you notice a newer version being referenced in the official documentation please open an issue or submit a pull request using the updated version. This resource is available in the `inspec-azure` [resource pack](/inspec/glossary/#resource-pack). To use it, add the following to your `inspec.yml` in your top-level profile: depends: name: inspec-azure git: https://github.com/inspec/inspec-azure.git You'll also need to setup your Azure credentials; see the resource pack . This resource first became available in 1.0.0 of the inspec-azure resource pack. An `azurermsecuritycenter_policy` resource block identifies a Security Center Policy by name. In the current Rest API you may only lookup a `default` policy. If no policy is given the default one will be used. describe azurermsecuritycenter_policy(name: 'default') do ... end describe azurermsecuritycenter_policy(name: 'default') do it { should exist } end describe azurermsecuritycenter_policy(name: 'default') do its('log_collection') { should eq('On') } end describe azurermsecuritycenter_policy(name: 'NonDefaultPolicy') do it { should_not exist } end `name` The name of the Security Center Policy. It must be `default`. If no name is given then it will search for the `default` Security Center Policy (Optional). describe azurermsecuritycenter_policy(name: 'default') do its('log_collection') { should eq('On') } end `id` `name` `log_collection` `patch` `baseline` `anti_malware` `disk_encryption` `networksecuritygroups` `webapplicationfirewall` `nextgenerationfirewall` `vulnerability_assessment` `storage_encryption` `justintimenetworkaccess` `app_whitelisting` `sql_auditing` `sqltransparentdata_encryption` `notifications_enabled`, `sendsecurityemailtoadmin` `contact_emails` `contact_phone` `pricing_tier` The id of the Security Center Policy. its('id') { should eq('/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Security/policies/default') } The name of the Security Center Policy. its('name') { should eq('default') } Log collection indicates if the monitoring agent will collect security data (`On`|`Off`). its('log_collection') { should eq('On') } Cost/Feature Model under which the subscription is operating (`Standard`|`Free`). its('pricing_tier') { should eq('Standard') } Patch indicates if system updates should be enabled for virtual machines

its('patch') { should eq('On') } Baseline indicates if OS vulnerabilities recommendations for virtual machines are enabled (`On`|`Off`). its('baseline') { should eq('On') } Anti-Malware indicates if endpoint protection recommendations for virtual machines are enabled (`On`|`Off`). its('anti_malware') { should eq('On') } Disk Encryption indicates if recommendations for virtual machines are enabled (`On`|`Off`). its('disk_encryption') { should eq('On') } Network security groups indicates if recommendations for virtual machines are enabled (`On`|`Off`). its('networksecuritygroups') { should eq('On') } Web application firewall indicates if recommendations for virtual machines are enabled (`On`|`Off`). its('webapplicationfirewall') { should eq('On') } Next generation firewall indicates if recommendations for virtual machines are enabled (`On`|`Off`). its('nextgenerationfirewall') { should eq('On') } Vulnerability assessment indicates if recommendations for virtual machines are enabled (`On`|`Off`). its('vulnerability_assessment') { should eq('On') } Storage Encryption indicates if new data in Azure Blobs and Files will be encrypted by default (`On`|`Off`). its('storage_encryption') { should eq('On') } Just in time network access indicates if recommendations for virtual machines are enabled (`On`|`Off`). its('justintimenetworkaccess') { should eq('On') } App whitelisting indicates if adaptive application controls are enabled (`On`|`Off`). its('app_whitelisting') { should eq('On') } SQL auditing indicates if auditing and threat detection recommendations are enabled (`On`|`Off`). its('sql_auditing') { should eq('On') } SQL transparent data encryption indicates if recommendations are enabled (`On`|`Off`). its('sqltransparentdata_encryption') { should eq('On') } Notifications enabled indicates if security alerts are emailed to the security contact (`true`|`false`). its('notifications_enabled') { should eq(true) } Send security email to admin indicates if the subscription admin will receive security alerts (`true`|`false`). its('sendsecurityemailtoadmin') { should eq(true) } Contact emails contains a list of security email addresses. its('contact_emails') { should include('security@example.com') } Contact phone contains the security contact phone number. its('contact_phone') { should eq('1-111-111-1111') } There are additional attributes that may be accessed that we have not documented. Please take a look at the . Any attribute in the response may be accessed with the key names separated by dots (`.`). The API may not always return keys that do not have any associated data. There may be cases where the deeply nested property may not have the desired attribute along your call chain. If you find yourself writing tests against properties that may be nil, fork this resource pack and add an accessor to the resource. Within that accessor you'll be able to guard against nil keys. Pull requests are always welcome. {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The control will pass if the resource returns a result. Use `should_not` if you expect zero matches. describe azurermsecuritycenter_policy(name: 'default') do it { should exist } end describe azurermsecuritycenter_policy(name: 'DoesNotExist') do it { should_not exist } end Your [Service Principal](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal) must be setup with a `contributor` role on the subscription you wish to test.