Project: Terrascan (Provisioning / Security & Compliance)
File: azure.md

| Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Identity and Access Management | azure | HIGH | Anonymous, public read access to a container and its blobs can be enabled in Azure Blob storage. This is only recommended if absolutely necessary. | accurics.azure.IAM.368 | ACAZURE0366 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | azure | HIGH | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server. | accurics.azure.NS.361 | ACAZURE0131 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | azure | MEDIUM | Restrict Azure SQL Server accessibility to a minimal address range | accurics.azure.NS.169 | ACAZURE0280 | | Infrastructure Security | azure | HIGH | Ensure entire Azure infrastructure doesn't have access to Azure SQL ServerEnsure entire Azure infrastructure doesn't have access to Azure SQL Server | accurics.azure.NS.5 | ACAZURE0381 | | Infrastructure Security | azure | MEDIUM | Ensure that no SQL Server allows ingress from 0.0.0.0/0 (ANY IP) | accurics.azure.NS.21 | ACAZURE0380 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Data Protection | azure | MEDIUM | Ensure the key vault is recoverable - enable "Soft Delete" setting for a Key Vault | accurics.azure.EKM.164 | ACAZURE0170 | | Logging and Monitoring | azure | HIGH | Ensure that logging for Azure KeyVault is 'Enabled' | accurics.azure.EKM.20 | ACAZURE0169 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Identity and Access Management | azure | LOW | Ensure that Azure Resource Group has resource lock enabled | accurics.azure.NS.272 | ACAZURE0389 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | azure | MEDIUM | Ensure default network access rule for Storage Accounts is set to deny. | accurics.azure.NS.370 | ACAZURE0309 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | azure | HIGH | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | accurics.azure.NS.2 | ACAZURE0371 | | Infrastructure Security | azure | HIGH | Ensure default network access rule for Storage Accounts is not open to public | accurics.azure.NS.4 | ACAZURE0370 | | Data Protection | azure | HIGH | Ensure that 'Secure transfer required' is enabled for Storage Accounts | accurics.azure.EKM.7 | ACAZURE0373 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Logging and Monitoring | azure | MEDIUM | Ensure that 'Auditing' is set to 'On' for SQL servers |

| ACAZURE0376 | | Identity and Access Management | azure | HIGH | Ensure that Azure Active Directory Admin is configured for SQL Server | accurics.azure.IAM.10 | ACAZURE0378 | | Compliance Validation | azure | MEDIUM | Avoid using names like 'Admin' for an Azure SQL Server admin account login | accurics.azure.IAM.138 | ACAZURE0377 | | Compliance Validation | azure | LOW | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers. | accurics.azure.LOG.356 | ACAZURE0375 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Logging and Monitoring | azure | MEDIUM | Ensure server parameter 'logduration' is set to 'ON' for PostgreSQL Database Server | accurics.azure.LOG.154 | ACAZURE_0411 | | Logging and Monitoring | azure | MEDIUM | Ensure server parameter 'logretentiondays' is greater than 3 days for PostgreSQL Database Server | accurics.azure.LOG.155 | ACAZURE0410 | | Logging and Monitoring | azure | MEDIUM | Ensure server parameter 'logconnections' is set to 'ON' for PostgreSQL Database Server | accurics.azure.LOG.152 | ACAZURE_0413 | | Logging and Monitoring | azure | MEDIUM | Ensure server parameter 'logcheckpoints' is set to 'ON' for PostgreSQL Database Server | accurics.azure.LOG.364 | ACAZURE_0409 | | Logging and Monitoring | azure | MEDIUM | Ensure server parameter 'logdisconnections' is set to 'ON' for PostgreSQL Database Server | accurics.azure.LOG.153 | ACAZURE_0412 | | Logging and Monitoring | azure | MEDIUM | Ensure server parameter 'connectionthrottling' is set to 'ON' for PostgreSQL Database Server | accurics.azure.LOG.151 | ACAZURE_0414 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Logging and Monitoring | azure | MEDIUM | Ensure that 'Threat Detection' is enabled for Azure SQL Database | accurics.azure.MON.157 | ACAZURE0383 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Security Best Practices | azure | HIGH | Ensure that Redis is updated regularly with security and operational updates.Note this feature is only available to Premium tier Redis Caches. | accurics.azure.NS.13 | ACAZURE0393 | | Infrastructure Security | azure | MEDIUM | Ensure that the Redis Cache accepts only SSL connections | accurics.azure.EKM.23 | ACAZURE0394 | | Infrastructure Security | azure | HIGH | Ensure there are no firewall rules allowing unrestricted access to Redis from other Azure sources | accurics.azure.NS.31 | ACAZURE0391 | | Infrastructure Security | azure | HIGH | Ensure there are no firewall rules allowing unrestricted access to Redis from the Internet | accurics.azure.NS.30 | ACAZURE0392 | | Infrastructure Security | azure | MEDIUM | Ensure there are no firewall rules allowing Redis Cache access for a large number of source IPs | accurics.azure.NS.166 | ACAZURE0390 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Logging and Monitoring | azure | MEDIUM | Ensure that 'Auditing' is set to 'On' for MSSQL servers | accurics.azure.MON.355 | ACAZURE0137 | | Logging and Monitoring | azure | MEDIUM | Ensure that 'Auditing' Retention is 'greater than 90 days' for MSSQL servers. |

| ACAZURE0136 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | azure | MEDIUM | Ensure Kube Dashboard is disabled | accurics.azure.NS.383 | ACAZURE0161 | | Infrastructure Security | azure | MEDIUM | Ensure AKS cluster has Network Policy configured. | accurics.azure.NS.382 | ACAZURE0158 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Data Protection | azure | MEDIUM | Ensure that 'Unattached disks' are encrypted in Azure Managed Disk | accurics.azure.EKM.156 | ACAZURE0143 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Resilience | azure | MEDIUM | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' for Azure Network Watcher Flow Log | accurics.azure.NS.342 | ACAZURE0419 | | Logging and Monitoring | azure | HIGH | Enable Network Watcher for Azure subscriptions. Network diagnostic and visualization tools available with Network Watcher help users understand, diagnose, and gain insights to the network in Azure. | accurics.azure.NS.11 | ACAZURE0418 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Data Protection | azure | HIGH | Ensure that all secrets have an expiration date set which must expire within 2 years | accurics.azure.EKM.26 | ACAZURE0163 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Data Protection | azure | HIGH | Ensure that the expiration date is set on all keys | accurics.azure.EKM.25 | ACAZURE0164 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Logging and Monitoring | azure | MEDIUM | Ensure that 'Send email notification for high severity alerts' is set to 'On' |

| ACAZURE0386 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | json | MEDIUM | Ensure Known internal web port (Tcp:8000) is not exposed to public for Azure Network Security Rule | ACAZURE0528 | ACAZURE0528 | | Infrastructure Security | json | LOW | Ensure NetBIOS Name Service (Udp:137) is not exposed to private hosts more than 32 for Azure Network Security Rule | ACAZURE0482 | ACAZURE0482 | | Infrastructure Security | json | LOW | Ensure Microsoft-DS (Tcp:445) is not exposed to private hosts more than 32 for Azure Network Security Rule | ACAZURE0494 | ACAZURE0494 | | Infrastructure Security | json | LOW | Ensure MSSQL Debugger (Tcp:135) is not exposed to private hosts more than 32 for Azure Network Security Rule | ACAZURE0512 | ACAZURE0512 | | Infrastructure Security | json | HIGH | Ensure PostgreSQL (Udp:5432) is not exposed to entire internet for Azure Network Security Rule | ACAZURE0457 | ACAZURE0457 | | Infrastructure Security | json | MEDIUM | Ensure Memcached SSL (Tcp:11215) is not exposed to public for Azure Network Security Rule | ACAZURE0504 | ACAZURE0504 | | Infrastructure Security | json | MEDIUM | Ensure SQL Server Analysis (Tcp:2382) is not exposed to public for Azure Network Security Rule | ACAZURE0441 | ACAZURE0441 | | Infrastructure Security | json | LOW | Ensure POP3 (Tcp:110) is not exposed to private hosts more than 32 for Azure Network Security Rule | ACAZURE0461 | ACAZURE0461 | | Infrastructure Security | json | LOW | Ensure Known internal web port (Tcp:8080) is not exposed to private hosts more than 32 for Azure Network Security Rule | ACAZURE0524 | ACAZURE0524 | | Infrastructure Security | json | HIGH | Ensure SaltStack Master (Tcp:4505) is not exposed to entire internet for Azure Network Security Rule | ACAZURE0436 | ACAZURE0436 | | Infrastructure Security | json | MEDIUM | Ensure NetBIOS Datagram Service (Udp:138) is not exposed to public for Azure Network Security Rule | ACAZURE0477 | ACAZURE0477 | | Infrastructure Security | json | HIGH | Ensure Hadoop Name Node (Tcp:9000) is not exposed to entire internet for Azure Network Security Rule | ACAZURE0532 | ACAZURE0532 | | Infrastructure Security | json | MEDIUM | Ensure Memcached SSL (Udp:11215) is not exposed to public for Azure Network Security Rule | ACAZURE0498 | ACAZURE0498 | | Infrastructure Security | json | MEDIUM | Ensure CIFS / SMB (Tcp:3020) is not exposed to public for Azure Network Security Rule | ACAZURE0271 | ACAZURE0271 | | Infrastructure Security | json | HIGH | Ensure Memcached SSL (Tcp:11214) is not exposed to entire internet for Azure Network Security Rule | ACAZURE0508 | ACAZURE0508 | | Infrastructure Security | json | LOW | Ensure MSSQL Server (Tcp:1433) is not exposed to private hosts more than 32 for Azure Network Security Rule | ACAZURE0509 | ACAZURE0509 | | Infrastructure Security | json | HIGH | Ensure CIFS / SMB (Tcp:3020) is not exposed to entire internet for Azure Network Security Rule | ACAZURE0270 | ACAZURE0270 | | Infrastructure Security | json | LOW | Ensure NetBIOS Datagram Service (Udp:138) is not exposed to private hosts more than 32 for Azure Network Security Rule | ACAZURE0476 | ACAZURE0476 | | Infrastructure Security | json | LOW | Ensure DNS (Udp:53) is not exposed to private hosts more than 32 for Azure Network Security Rule | ACAZURE0533 | ACAZURE0533 | | Infrastructure Security | json | HIGH | Ensure Memcached SSL (Udp:11215) is not