Updating custom policies to evaluate TLS 1.3 successfully

docs/wiki/Whats-new.md

@@ -49,6 +49,7 @@ Here's what's changed in Enterprise Scale/Azure Landing Zones:
 
 ### 🔃 Policy Refresh Q1 FY25
 
+- Updated ALZ custom policies enforcing minimum TLS versions to properly evaluate the minimum TLS version, ensuring services configured to deploy TLS 1.3 will successfully evaluate.
 - Updated the initiative [Deploy-MDFC-Config_20240319](https://www.azadvertizer.net/azpolicyinitiativesadvertizer/Deploy-MDFC-Config_20240319.html) to the the newer version of DCSPM: [Configure Microsoft Defender CSPM plan](https://www.azadvertizer.net/azpolicyadvertizer/72f8cee7-2937-403d-84a1-a4e3e57f3c21.html)
 - Updated [Deploy-Private-DNS-Generic](https://www.azadvertizer.net/azpolicyadvertizer/Deploy-Private-DNS-Generic.html) policy to include the ability to configure the location/region.
 - Removed duplicate assignment and portal option of [Deploy Azure Policy Add-on to Azure Kubernetes Service clusters](https://www.azadvertizer.net/azpolicyadvertizer/a8eff44f-8c92-45c3-a3fb-9880802d67a7.html) at Landing Zones scope, as this policy is assigned in the initiative [Deploy Microsoft Defender for Cloud configuration](https://www.azadvertizer.net/azpolicyinitiativesadvertizer/Deploy-MDFC-Config_20240319.html) at Intermediate Root scope.

src/resources/Microsoft.Authorization/policyDefinitions/Append-AppService-latestTLS.json

@@ -9,7 +9,7 @@
     "displayName": "AppService append sites with minimum TLS version to enforce.",
     "description": "Append the AppService sites object to ensure that min Tls version is set to required minimum TLS version. Please note Append does not enforce compliance use then deny.",
     "metadata": {
-      "version": "1.1.0",
+      "version": "1.2.0",
       "category": "App Service",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -35,6 +35,7 @@
         "type": "String",
         "defaultValue": "1.2",
         "allowedValues": [
+          "1.3",
           "1.2",
           "1.0",
           "1.1"
@@ -54,7 +55,7 @@
           },
           {
             "field": "Microsoft.Web/sites/config/minTlsVersion",
-            "notEquals": "[[parameters('minTlsVersion')]"
+            "less": "[[parameters('minTlsVersion')]"
           }
         ]
       },

src/resources/Microsoft.Authorization/policyDefinitions/Append-Redis-sslEnforcement.json

@@ -9,7 +9,7 @@
     "displayName": "Azure Cache for Redis Append a specific min TLS version requirement and enforce TLS.",
     "description": "Append a specific min TLS version requirement and enforce SSL on Azure Cache for Redis. Enables secure server to client by enforce  minimal Tls Version to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.",
     "metadata": {
-      "version": "1.0.0",
+      "version": "1.1.0",
       "category": "Cache",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -56,7 +56,7 @@
             "anyOf": [
               {
                 "field": "Microsoft.Cache/Redis/minimumTlsVersion",
-                "notequals": "[[parameters('minimumTlsVersion')]"
+                "less": "[[parameters('minimumTlsVersion')]"
               }
             ]
           }

src/resources/Microsoft.Authorization/policyDefinitions/Deny-EH-MINTLS.json

@@ -9,7 +9,7 @@
         "displayName": "Event Hub namespaces should use a valid TLS version",
         "description": "Event Hub namespaces should use a valid TLS version.",
         "metadata": {
-            "version": "1.0.0",
+            "version": "1.1.0",
             "category": "Event Hub",
             "source": "https://github.com/Azure/Enterprise-Scale/",
             "alzCloudEnvironments": [
@@ -52,7 +52,7 @@
                         "anyOf": [
                             {
                                 "field": "Microsoft.EventHub/namespaces/minimumTlsVersion",
-                                "notEquals": "[[parameters('minTlsVersion')]"
+                                "less": "[[parameters('minTlsVersion')]"
                             },
                             {
                                 "field": "Microsoft.EventHub/namespaces/minimumTlsVersion",

src/resources/Microsoft.Authorization/policyDefinitions/Deny-MySql-http.json

@@ -9,7 +9,7 @@
     "displayName": "MySQL database servers enforce SSL connections.",
     "description": "Azure Database for MySQL supports connecting your Azure Database for MySQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.",
     "metadata": {
-      "version": "1.0.0",
+      "version": "1.1.0",
       "category": "SQL",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -66,7 +66,7 @@
               },
               {
                 "field": "Microsoft.DBforMySQL/servers/minimalTlsVersion",
-                "notequals": "[[parameters('minimalTlsVersion')]"
+                "less": "[[parameters('minimalTlsVersion')]"
               }
             ]
           }

src/resources/Microsoft.Authorization/policyDefinitions/Deny-Redis-http.json

@@ -9,7 +9,7 @@
     "displayName": "Azure Cache for Redis only secure connections should be enabled",
     "description": "Audit enabling of only connections via SSL to Azure Cache for Redis. Validate both minimum TLS version and enableNonSslPort is disabled. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking",
     "metadata": {
-      "version": "1.0.0",
+      "version": "1.1.0",
       "category": "Cache",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -41,7 +41,7 @@
           "1.0"
         ],
         "metadata": {
-          "displayName": "Select minumum TLS version for Azure Cache for Redis.",
+          "displayName": "Select minimum TLS version for Azure Cache for Redis.",
           "description": "Select minimum TLS version for Azure Cache for Redis."
         }
       }
@@ -61,7 +61,7 @@
               },
               {
                 "field": "Microsoft.Cache/Redis/minimumTlsVersion",
-                "notequals": "[[parameters('minimumTlsVersion')]"
+                "less": "[[parameters('minimumTlsVersion')]"
               }
             ]
           }

src/resources/Microsoft.Authorization/policyDefinitions/Deny-Sql-minTLS.json

@@ -9,7 +9,7 @@
     "displayName": "Azure SQL Database should have the minimal TLS version set to the highest version",
     "description": "Setting minimal TLS version to 1.2 improves security by ensuring your Azure SQL Database can only be accessed from clients using TLS 1.2. Using versions of TLS less than 1.2 is not reccomended since they have well documented security vunerabilities.",
     "metadata": {
-      "version": "1.0.0",
+      "version": "1.1.0",
       "category": "SQL",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -61,7 +61,7 @@
               },
               {
                 "field": "Microsoft.Sql/servers/minimalTlsVersion",
-                "notequals": "[[parameters('minimalTlsVersion')]"
+                "less": "[[parameters('minimalTlsVersion')]"
               }
             ]
           }

src/resources/Microsoft.Authorization/policyDefinitions/Deny-SqlMi-minTLS.json

@@ -7,9 +7,9 @@
     "policyType": "Custom",
     "mode": "Indexed",
     "displayName": "SQL Managed Instance should have the minimal TLS version set to the highest version",
-    "description": "Setting minimal TLS version to 1.2 improves security by ensuring your SQL Managed Instance can only be accessed from clients using TLS 1.2. Using versions of TLS less than 1.2 is not reccomended since they have well documented security vunerabilities.",
+    "description": "Setting minimal TLS version to 1.2 improves security by ensuring your SQL Managed Instance can only be accessed from clients using TLS 1.2. Using versions of TLS less than 1.2 is not recommended since they have well documented security vulnerabilities.",
     "metadata": {
-      "version": "1.0.0",
+      "version": "1.1.0",
       "category": "SQL",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -61,7 +61,7 @@
               },
               {
                 "field": "Microsoft.Sql/managedInstances/minimalTlsVersion",
-                "notequals": "[[parameters('minimalTlsVersion')]"
+                "less": "[[parameters('minimalTlsVersion')]"
               }
             ]
           }

src/resources/Microsoft.Authorization/policyDefinitions/Deploy-MySQL-sslEnforcement.json

@@ -9,7 +9,7 @@
     "displayName": "Azure Database for MySQL server deploy a specific min TLS version and enforce SSL.",
     "description": "Deploy a specific min TLS version requirement and enforce SSL on Azure Database for MySQL server. Enforce the Server to client applications using minimum version of Tls to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.",
     "metadata": {
-      "version": "1.1.0",
+      "version": "1.2.0",
       "category": "SQL",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -61,7 +61,7 @@
               },
               {
                 "field": "Microsoft.DBforMySQL/servers/minimalTlsVersion",
-                "notequals": "[[parameters('minimalTlsVersion')]"
+                "less": "[[parameters('minimalTlsVersion')]"
               }
             ]
           }

src/resources/Microsoft.Authorization/policyDefinitions/Deploy-PostgreSQL-sslEnforcement.json

@@ -9,7 +9,7 @@
     "displayName": "Azure Database for PostgreSQL server deploy a specific min TLS version requirement and enforce SSL ",
     "description": "Deploy a specific min TLS version requirement and enforce SSL on Azure Database for PostgreSQL server. Enables secure server to client by enforce  minimal Tls Version to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.",
     "metadata": {
-      "version": "1.1.0",
+      "version": "1.2.0",
       "category": "SQL",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -61,7 +61,7 @@
               },
               {
                 "field": "Microsoft.DBforPostgreSQL/servers/minimalTlsVersion",
-                "notEquals": "[[parameters('minimalTlsVersion')]"
+                "less": "[[parameters('minimalTlsVersion')]"
               }
             ]
           }

src/resources/Microsoft.Authorization/policyDefinitions/Deploy-SQL-minTLS.json

@@ -9,7 +9,7 @@
     "displayName": "SQL servers deploys a specific min TLS version requirement.",
     "description": "Deploys a specific min TLS version requirement and enforce SSL on SQL servers. Enables secure server to client by enforce  minimal Tls Version to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.",
     "metadata": {
-      "version": "1.1.0",
+      "version": "1.2.0",
       "category": "SQL",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -54,7 +54,7 @@
           },
           {
             "field": "Microsoft.Sql/servers/minimalTlsVersion",
-            "notequals": "[[parameters('minimalTlsVersion')]"
+            "less": "[[parameters('minimalTlsVersion')]"
           }
         ]
       },

src/resources/Microsoft.Authorization/policyDefinitions/Deploy-SqlMi-minTLS.json

@@ -9,7 +9,7 @@
     "displayName": "SQL managed instances deploy a specific min TLS version requirement.",
     "description": "Deploy a specific min TLS version requirement and enforce SSL on SQL managed instances. Enables secure server to client by enforce  minimal Tls Version to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.",
     "metadata": {
-      "version": "1.2.0",
+      "version": "1.3.0",
       "category": "SQL",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -54,7 +54,7 @@
           },
           {
             "field": "Microsoft.Sql/managedInstances/minimalTlsVersion",
-            "notequals": "[[parameters('minimalTlsVersion')]"
+            "less": "[[parameters('minimalTlsVersion')]"
           }
         ]
       },

src/resources/Microsoft.Authorization/policyDefinitions/Deploy-Storage-sslEnforcement.json

@@ -9,7 +9,7 @@
     "displayName": "Azure Storage deploy a specific min TLS version requirement and enforce SSL/HTTPS ",
     "description": "Deploy a specific min TLS version requirement and enforce SSL on Azure Storage. Enables secure server to client by enforce minimal Tls Version to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your Azure Storage.",
     "metadata": {
-      "version": "1.2.0",
+      "version": "1.3.0",
       "category": "Storage",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -60,7 +60,7 @@
               },
               {
                 "field": "Microsoft.Storage/storageAccounts/minimumTlsVersion",
-                "notEquals": "[[parameters('minimumTlsVersion')]"
+                "less": "[[parameters('minimumTlsVersion')]"
               }
             ]
           }